A free, read-only check for Wazuh 4.x. It lists every custom rule that did not fire and tells you the most likely reason, including rules that Wazuh silently threw away while loading them.

One Python 3 file, standard library only. It reads files; it changes nothing on your manager and sends nothing anywhere.

curl -sLO https://github.com/xuxu298/rule-doctor-lite/releases/latest/download/rule-doctor-lite.py

sudo python3 rule-doctor-lite.py # on the manager, reads /var/ossec

python3 rule-doctor-lite.py --ossec-dir ./copy # or on a copy of /var/ossecOr from PyPI (same file, with a rule-doctor-lite command):

pipx install rule-doctor-lite # or pip install rule-doctor-lite inside a venv

sudo "$(command -v rule-doctor-lite)" # on the manager, reads /var/ossecManager in docker? Copy the four things it reads, then point --ossec-dir at the copy:

C=single-node-wazuh.manager-1; mkdir -p copy/ruleset copy/etc copy/logs/alerts

docker cp $C:/var/ossec/ruleset/rules copy/ruleset/ && docker cp $C:/var/ossec/etc/rules copy/etc/

docker cp $C:/var/ossec/logs/ossec.log copy/logs/ && docker cp $C:/var/ossec/logs/alerts/alerts.json copy/logs/alerts/The shadowed / never-reaches-the-manager / no-match split is Kislley Rodrigues's.

Every result is printed with the time window it was measured over. A rule written for a quarterly event is not dead after a day.

What it reads by default (0.2.1): the current logs/alerts/alerts.json plus the rotated alert files of the last 7 days (logs/alerts/<year>/<Mon>/ossec-alerts-<dd>.json, plain or .gz, as Wazuh writes them); change the window with --days N. From ossec.log it takes the 7617/7619 warnings of the latest rule load only (the block before the last Total rules enabled), so a rule you already fixed is not reported from an older load, and lines from wazuh-analysisd -t are ignored.

wazuh/wazuh-manager:4.14.7, 27/09/2026. Two identical custom rules on if_sid 5715, one in 0094-test.xml (sorts before the stock 0095-sshd_rules.xml), one in 0500-ok.xml. A real sshd "Accepted password" event fired 100081 from 0500-ok.xml; 100080 in 0094-test.xml never fired. Rule Doctor Lite reported:

100080 level 10 0094-test.xml DROPPED-AT-LOAD ossec.log 7617: parent 5715 not found when the rule loaded

and, with ossec.log withheld, the same verdict from the load order alone:

100080 level 10 0094-test.xml DROPPED-AT-LOAD predicted: parent 5715 is in 0095-sshd_rules.xml, which loads after 0094-test.xml

Same image. Anchor 910010 on if_sid 5715 in 0094-early.xml, child 910012 on if_sid 910010 and grandchild 910013 on if_sid 910012 in 0500-chain.xml. wazuh-analysisd -t exited 0; ossec.log had 7617 + 7619 for all three, each naming the rule above it as the missing parent. Lite, with ossec.log withheld:

910010 level 10 0094-early.xml DROPPED-AT-LOAD predicted: parent 5715 is in 0095-sshd_rules.xml, which loads after 0094-early.xml

910012 level 10 0500-chain.xml DROPPED-AT-LOAD predicted: parent 910010 is itself dropped at load

910013 level 12 0500-chain.xml DROPPED-AT-LOAD predicted: parent 910012 is itself dropped at load

The prediction matters because ossec.log can miss warnings: analysisd buffers the warnings of each rules file in a list capped at 50 (ERRORLIST_MAXSIZE) and flushes it after the file, so a file that produces more than 50 warnings loses the oldest ones (src/analysisd/analysisd.c L708-750 on v4.14.7).

tests/run.sh runs the fixture checks without docker.

- Wazuh 4.x rule syntax. Only if_sidparents are read;if_group,if_matched_sidandif_matched_groupare not followed yet.

- NEVER-REACHES-MANAGERonly sees loss that raised rule 203 or 204 (see the table above).

- SHADOW-CANDIDATEneeds a replay to confirm or clear. Lite does not replay.

- "Never fired" means never fired in the alerts it read (7 days by default). Older alerts need --daysor--alerts.

Step-by-step notes for what Lite points at, each with a one-minute check you can run yourself (measured on Wazuh 4.14.7):

- Wazuh rule dropped at load: 7617 and 7619, while wazuh-analysisd -texits 0

- Wazuh rule matches in wazuh-logtest but never fires in production

- Wazuh rule shadowed by a sibling rule

- mapper_parsing_exception: the alert is in alerts.json but never reaches the dashboard

- Wazuh "Cannot read 'srcip' from data"

- Wazuh rule with <hostname>matches in logtest but never fires for agent events

- ATK Rule Doctor (USD 490 per cluster per year) replays the real events behind every SHADOW-CANDIDATEthrough a throwaway manager of your version to confirm or clear it, and fixes alerts the indexer rejects withmapper_parsing_exception: https://vct.atkvn.com/rule-doctor.html

- Rule Fix Pack: we fix a silent rule or a mapping conflict on your version, fixed price, and you pay only after the fix fires on your cluster. Write to dongnx@atkvn.com.

Licence: Apache-2.0. Made by ATK New Technology, Hanoi.