Ci-Cd

“Wazuh Static Analysis” series:

• Part 1: Decoders - decoder XML validation
• Part 2: Rules (you are here) - rule validation and cross-type checking

In Part 1 we built a linter for Wazuh decoder XML files - a tool that validates structure, regex/order consistency, and parent-child decoder chains. But decoders are only half of the event processing pipeline. Decoders extract fields from raw logs, while rules decide what to do with those fields: generate an alert, escalate a threat level, or trigger an automated response. An error in a rule - a missed alert or a false positive - can be more dangerous than a decoder misconfiguration.

“Wazuh Static Analysis” series:

• Part 1: Decoders (you are here) - decoder XML validation
• Part 2: Rules - rule validation and cross-type checking

Wazuh decoder XML files define how raw log lines are parsed into structured security events. A misconfigured decoder – a missing <order> element, an orphaned parent reference, or a regex group mismatch – can silently drop critical fields from alerts, leaving blind spots in your SIEM pipeline. Manual code review catches some of these issues, but it does not scale across hundreds of decoder files shipped with Wazuh or maintained by your organization.