Show HN: Find Wazuh rules that never fire, including ones dropped at load

Category: devtools

Tags: wazuh, siem, rule-diagnostics, log-analysis

Score: 6.3/10 (Innovation: 6, Technical: 6, Documentation: 7, Utility: 6)

ATK Rule Doctor Lite is a single-file Python tool that diagnoses why custom Wazuh rules never fire, including rules silently dropped at load due to missing if_sid parents. It reads logs and rule files, classifies silence (dropped, shadowed, never reaches manager, no match), and follows parent chains, while remaining read-only and dependency-free.

Target audience: devops, security engineers, SIEM administrators

Repository: https://github.com/xuxu298/rule-doctor-lite · Python · Apache-2.0 · 1 stars

View on Hacker News