# Wazuh 4.14 Rules and Decoders - Event Analysis

> Overview of the Wazuh 4.14 analysis engine covering threat detection rules, log data extraction decoders, alert classification, and testing

Source: https://opennix.org/en/docs/wazuh/rules-decoders/


This section describes the Wazuh 4.14 event analysis engine: threat detection rules and decoders that extract structured data from raw logs. Understanding how these components work is essential for tailoring the platform to a specific infrastructure and building custom detection logic.

## How Event Analysis Works

Wazuh processes each incoming event in three stages:

1. **Pre-decoding** - extraction of standard syslog fields: timestamp, hostname, program name
2. **Decoding** - extraction of message-specific fields from the log body: IP addresses, usernames, actions, URLs
3. **Rule matching** - comparison of the decoded event against the ruleset to generate alerts

Decoders and rules work in tandem: the decoder prepares structured data, and the rule determines whether the event is security-relevant.

## Section Contents

### [Detection Rules](/docs/wazuh/rules-decoders/wazuh-rules/)

Complete coverage of Wazuh rule syntax: XML elements (id, level, description, group, match, regex, if_sid, frequency, timeframe), rule ordering and overwriting, default ruleset overview, MITRE ATT&CK mapping, rule levels 0-15, composite rules, CDB lists, and testing with wazuh-logtest.

### [Decoders](/docs/wazuh/rules-decoders/wazuh-decoders/)

Wazuh decoder syntax: XML elements (name, parent, regex, order, prematch, program_name, type), parent-child decoder hierarchy, the pre-decoding phase, default decoders overview, JSON decoder, writing custom decoders, and testing with wazuh-logtest.

## Default Ruleset

Wazuh ships with over 4000 rules and 1500 decoders out of the box. The default ruleset covers:

- Operating systems (Linux, Windows, macOS)
- Network devices (Cisco, Fortinet, pfSense)
- Web servers (Apache, Nginx, IIS)
- Databases (MySQL, PostgreSQL, MongoDB)
- Cloud platforms (AWS, Azure, GCP)
- Security applications (Suricata, OSSEC, ClamAV)
- Authentication systems (PAM, LDAP, Active Directory)

Default rules are stored in `/var/ossec/ruleset/rules/`, decoders in `/var/ossec/ruleset/decoders/`. These files are updated during Wazuh upgrades and should not be edited directly.

## Custom Rules and Decoders

Custom rules and decoders are placed in separate files that are preserved during upgrades:

- Rules: `/var/ossec/etc/rules/local_rules.xml`
- Decoders: `/var/ossec/etc/decoders/local_decoder.xml`

Detailed instructions for creating custom rules and decoders are provided in the respective subsections.

## Testing

Wazuh provides the `wazuh-logtest` utility for interactively testing decoders and rules without affecting the production system:

```bash
/var/ossec/bin/wazuh-logtest
```

For more on testing, see the [rules](/docs/wazuh/rules-decoders/wazuh-rules/) and [decoders](/docs/wazuh/rules-decoders/wazuh-decoders/) sections.

## Related Sections

- [Log Analysis](/docs/wazuh/capabilities/wazuh-log-data-collection/) - log collection and processing
- [File Integrity Monitoring](/docs/wazuh/capabilities/wazuh-file-integrity-monitoring/) - FIM with YARA support
- [Active Response](/docs/wazuh/capabilities/wazuh-active-response/) - actions triggered by rules