1 · Log lines
The first line defines the template; every line is run through the test · Ctrl+Enter
2 · Decoders to test
The file is read in the browser — nothing is uploaded. Each line shows which decoder takes it, the fields, and why.
2 · What was detected
3 · Fields to extract
4 · Generation settings
5 · AI assistantoptional
Patch mode: the model only says what to change — renames, dropped fields, rule levels, an alert on a value or on repeats — and the workbench writes the XML. Full rewrites are verified by the simulator.
Your log samples and request are sent to the endpoint above. With a local model (Ollama / LM Studio) nothing leaves your machine. The API key is stored only in this browser (localStorage). Local endpoints over http may require opening this page locally if your browser blocks it; Ollama also needs
OLLAMA_ORIGINS to include this site.How to deploy
- Decoder →
/var/ossec/etc/decoders/local_decoder.xml, rules →/var/ossec/etc/rules/local_rules.xml(on the manager). - Custom rule IDs belong to the
100000–120000range. - Verify before restarting:
/var/ossec/bin/wazuh-logtest— paste the same log line there. - Apply:
systemctl restart wazuh-manager. - Level ≥ 3 creates an alert (by default); level ≥ 12 — critical events.
- OS_Regex:
\.+means “any characters” and stops as soon as the rest of the pattern fits (it is lazy):devname="(\.+)"ends at the first quote. At the end of a pattern it takes the rest of the line. Matching ignores case. - The test here approximates the Wazuh engine. Always do the final check in
wazuh-logtest.