When a log reaches Wazuh, it goes through four phases: pre-decoder (extracts the date and program), decoder (extracts fields with regex), rules (checks whether the event is relevant) and alert generation (if the rule matches, Wazuh notifies by email, Discord or Slack).
How do logs flow through Wazuh from entry to alert?
When a log enters Wazuh, it goes through several processing phases until it becomes an alert visible in the dashboard or sent by email/Discord/Slack. Understanding this flow is essential to create custom rules and configure effective alerts.
What does the log processing flow look like?
What does the pre-decoder do (phase 1)?
The first processing phase. The pre-decoder extracts the basic fields from the log:
- Timestamp: Date and time of the event
- Hostname: Name of the machine that generates the log
- Program: Application that generates the log (sshd, apache, etc.)
It normalizes the format so the decoder can work with a structured log.
What does the decoder extract (phase 2)?
Analyzes the log content and extracts specific variables using regular expressions. For example, from an SSH log:
Feb 14 12:30:45 server sshd[1234]: Failed password for admin from 192.168.1.100 port 22 ssh2The decoder extracts:
- User: admin
- Source IP: 192.168.1.100
- Port: 22
- Result: Failed (failed attempt)
How do rules evaluate the event (phase 3)?
Rules evaluate the fields extracted by the decoder. If the log matches a rule, an event is generated with a severity level (0-15).
- Level 0-3: Informational, usually not indexed
- Level 4-7: Events of interest, indexed
- Level 8-11: Important alerts
- Level 12-15: Critical, requires immediate action
Rules can inherit from other parent rules using if_sid, allowing you to build detection hierarchies.
When are events indexed (phase 4)?
Events that exceed the configured level threshold are indexed in the database (Elasticsearch/OpenSearch) and appear in the Wazuh dashboard.
How are alerts generated and sent (phase 5)?
Depending on the configuration, events can trigger alerts through different channels:
- Email: SMTP configured in ossec.conf
- Discord: Webhook integration
- Slack: Webhook integration
- TheHive: Create cases automatically
- PagerDuty: Incident escalation
Alert configuration is done in the manager's ossec.conf, using the <integration> block.
What does the full flow look like at a glance?
| Phase | Function | Location |
| Pre-decoder | Extracts basic fields | /var/ossec/etc/decoders/ |
| Decoder | Extracts specific variables | /var/ossec/etc/decoders/ |
| Rules | Evaluates and assigns a level | /var/ossec/etc/rules/ |
| Alerts | Notifies via channel | /var/ossec/etc/ossec.conf |
Frequently Asked Questions
What are the phases a log goes through in Wazuh?
A log goes through pre-decoder (extracts timestamp, hostname and program), decoder (extracts specific fields like user, IP and port using regex), rules (evaluates the event and assigns a severity level from 0 to 15), indexing (stores it if it exceeds the threshold) and alert generation (notifies via email, Discord, Slack and other channels).
What is the difference between the pre-decoder and the decoder?
The pre-decoder normalizes the log and extracts basic fields common to almost any entry: timestamp, hostname and program name. The decoder then analyzes the message body with regular expressions to extract specific variables such as the user, the source IP, the port or the action.
What do the Wazuh rule severity levels mean?
Wazuh assigns each matched event a level from 0 to 15. Levels 0-3 are informational and usually not indexed, 4-7 are events of interest that get indexed, 8-11 are important alerts, and 12-15 are critical events that require immediate action.
Where are decoders, rules and alert settings stored?
Decoders live in /var/ossec/etc/decoders/, rules live in /var/ossec/etc/rules/, and alert integrations are configured in the manager's /var/ossec/etc/ossec.conf using the <integration> block.
Which channels can Wazuh send alerts to?
Wazuh can notify through email (SMTP configured in ossec.conf), Discord and Slack via webhook integrations, TheHive to create cases automatically, and PagerDuty for incident escalation.
Next steps
Our team can help you create custom decoders and rules, and set up integrations with Discord and Slack as part of a professional Wazuh deployment. Learn about professional implementation.