1 · Log lines
The first line defines the template; every line is run through the test · Ctrl+Enter
2 · What was detected
3 · Fields to extract
4 · Generation settings
5 · AI assistantoptional
The reply is verified against your sample lines by the built-in simulator
Your log samples and request are sent to the endpoint above. With a local model (Ollama / LM Studio) nothing leaves your machine. The API key is stored only in this browser (localStorage). Local endpoints over http may require opening this page locally if your browser blocks it; Ollama also needs
OLLAMA_ORIGINS to include this site.How to deploy
- Decoder →
/var/ossec/etc/decoders/local_decoder.xml, rules →/var/ossec/etc/rules/local_rules.xml(on the manager). - Custom rule IDs belong to the
100000–120000range. - Verify before restarting:
/var/ossec/bin/wazuh-logtest— paste the same log line there. - Apply:
systemctl restart wazuh-manager. - Level ≥ 3 creates an alert (by default); level ≥ 12 — critical events.
- OS_Regex:
\.+means “any characters” and it is greedy: for quoted values the PCRE2 dialect ([^"]*) is more reliable. - The test here approximates the Wazuh engine. Always do the final check in
wazuh-logtest.