How to Create Custom Rules in Wazuh: Detect Access and Actions

Custom Wazuh rules are written in XML inside /var/ossec/etc/rules/local_rules.xml. Each rule defines a unique ID (above 100000), the severity level, the log field that must match and the description of the alert you will see in the dashboard.

How do you create custom Wazuh rules step by step?

Custom rules in Wazuh let you detect specific patterns in your logs and trigger alerts when certain conditions are met. In this article we go through practical examples using NAS logs: detecting folder access, specific users and actions such as Delete or Write.

What does the basic structure of a rule look like?

Wazuh rules are defined in XML files inside /var/ossec/etc/rules/. Out of the box Wazuh ships with roughly 3,000 built-in rules using IDs below 100000, so every custom rule you write must use an ID of 100000 or higher to survive future updates. The basic structure is:

<rule id="100071" level="10">
  <if_sid>100070</if_sid>
  <field name="campo">valor</field>
  <description>Descripción de la alerta</description>
</rule>

Components:

• id: Unique rule identifier (100000+ for custom rules)
• level: Alert severity (0-15)
• if_sid: Parent rule it inherits from (the decoder)
• field: Field extracted by the decoder to evaluate
• description: Alert text that appears in the dashboard

How do you detect access to a specific folder?

Input log:

NAS: Users: marialopez, Source IP: 192.168.1.100, Computer name: MariaPC, Connection type: SMB, Accessed resources: Dpto_direccion/Certificados/CertificadoDigital.pfc, Action: Write

Rule:

<rule id="100071" level="10">
  <if_sid>100070</if_sid>
  <field name="resource">Dpto_direccion</field>
  <description>Acceso a carpeta Direccion en NAS</description>
</rule>

How it works:

• Inherits from rule 100070 (the generic NAS decoder)
• Filters on the resource field that contains "Dpto_direccion"
• Triggers a level 10 alert whenever any user accesses that folder

How do you match a specific user and action together?

Input log:

NAS: Users: Juan, Source IP: 192.168.1.100, Computer name: MariaPC, Connection type: SMB, Accessed resources: sdsds/Certificados/CertificadoDigital.pfc, Action: Delete

Rule:

<rule id="100072" level="10">
  <if_sid>100070</if_sid>
  <field name="srcusernas">Juan</field>
  <field name="actionNas">Delete</field>
  <description>El usuario Juan ha eliminado un fichero</description>
</rule>

How it works:

• Uses two fields for greater precision
• Only fires if the user is "Juan" AND the action is "Delete"
• Useful for auditing the actions of specific users

How do you use dynamic variables for IP and action?

Input log:

NAS: Users: marialopez, Source IP: 192.168.1.155, Computer name: MariaPC, Connection type: SMB, Accessed resources: sdsds/Certificados/CertificadoDigital.pfc, Action: Write

Rule:

<rule id="100073" level="10">
  <if_sid>100070</if_sid>
  <field name="srcipNas">192.168.1.155</field>
  <field name="actionNas">Write</field>
  <description>El equipo con la IP $(srcipNas) ha modificado el fichero $(resource)</description>
</rule>

How it works:

• Filters on a specific source IP + the Write action
• Uses dynamic variables $(field) in the description
• The alert will include the real values from the log: IP and affected resource

Syntax summary

Where do you add the rules and how do you apply them?

Custom rules are added in /var/ossec/etc/rules/local_rules.xml. After editing the file, restart the manager:

systemctl restart wazuh-manager

Next steps

Building custom decoders to extract the fields you need is part of a full Wazuh deployment. A decoder turns a raw log line into named fields such as resource, srcusernas or actionNas, and only then can a rule like the ones above filter on them. In a typical NAS audit project we pair one decoder with five to ten focused rules so that high-value folders, privileged users and destructive actions each get their own severity level, which keeps the dashboard signal-to-noise ratio high. Discover our Wazuh services.

Frequently Asked Questions

Where are custom Wazuh rules stored?

Custom rules live in /var/ossec/etc/rules/local_rules.xml on the Wazuh manager. After editing the file you must restart the service with systemctl restart wazuh-manager for the changes to take effect.

What rule ID range should I use for custom rules?

Wazuh reserves IDs below 100000 for its built-in ruleset (around 3,000 rules ship by default). Always assign your own rules an ID of 100000 or higher to avoid collisions with future updates of the official rules.

What does the level attribute mean in a Wazuh rule?

The level sets the alert severity from 0 to 15: 0-3 is informational, 4-7 is medium, and 8-15 is critical. By default Wazuh only emails alerts at level 7 or above, so the level also controls which events trigger notifications.

How do I match more than one field in a single rule?

Add multiple <field name="..."> tags inside the same <rule> block. All of them must match for the rule to fire, which works as a logical AND, for example matching a specific user and the Delete action at the same time.

What are dynamic variables in a Wazuh rule description?

Dynamic variables use the $(field) syntax inside the <description> tag. Wazuh substitutes them with the real value extracted by the decoder, so the alert shows the actual source IP or affected resource instead of static text.