https://blog.pytoshka.me/en/tags/log-parsing/Recent content in Log-Parsing on pyToshka's DevSecOps BlogHugoen-USping@pytoshka.me (pyToshka)ping@pytoshka.me (pyToshka)Wed, 15 Apr 2026 10:36:10 +0400https://blog.pytoshka.me/en/post/wazuh-static-analysis-decoders/Tue, 17 Feb 2026 00:00:00 +0000ping@pytoshka.me (pyToshka)https://blog.pytoshka.me/en/post/wazuh-static-analysis-decoders/<p><strong>&ldquo;Wazuh Static Analysis&rdquo; series:</strong></p> <ul> <li><strong>Part 1: Decoders</strong> (you are here) - decoder XML validation</li> <li><a href="https://blog.pytoshka.me/en/post/wazuh-static-analysis-rules/">Part 2: Rules</a> - rule validation and cross-type checking</li> </ul> <p>Wazuh decoder XML files define how raw log lines are parsed into structured security events. A misconfigured decoder &ndash; a missing <code>&lt;order&gt;</code> element, an orphaned parent reference, or a regex group mismatch &ndash; can silently drop critical fields from alerts, leaving blind spots in your SIEM pipeline. Manual code review catches some of these issues, but it does not scale across hundreds of decoder files shipped with Wazuh or maintained by your organization.</p>