Issues

macOS ULS collection: the page says the agent uses --style syslog, but 4.14.10 agents on macOS 10.15 and later run the log tool with --style ndjson

wazuh/wazuh-documentation#10537 · opened

on Oct 27, 2026

Windows Registry `recursion_level`: the example says FIM alerts on `Subkey_3`, but with `recursion_level="3"` the agent stops at `level_3`

wazuh/wazuh-documentation#10523 · opened

on Oct 26, 2026

Solaris agent installation: error in the manager address configuration step

wazuh/wazuh-documentation#10522 · opened

on Oct 26, 2026

GCP posture management: the custom rules show an empty project name because the exported findings have no `resource.projectDisplayName`

wazuh/wazuh-documentation#10521 · opened

on Oct 26, 2026

Windows Registry `report_changes`: the documented value types are incomplete and differ between two pages

wazuh/wazuh-documentation#10515 · opened

on Oct 26, 2026

GCP dependencies: the documented steps do not give a working Google Cloud module on CentOS 7

wazuh/wazuh-documentation#10513 · opened

on Oct 26, 2026

Puppet deployment: the running `puppet` service can apply `stack.pp` before the Wazuh certificates exist, and that run fails

wazuh/wazuh-documentation#10512 · opened

on Oct 26, 2026

Agent from sources: the CentOS 6/7 steps fail with cmake not found, and Amazon Linux has no tab

wazuh/wazuh-documentation#10511 · opened

on Oct 26, 2026

AWS module docs: the agent dependency steps fail on Amazon Linux 2 and on Python 3.8, and the discard_regex example never matches

wazuh/wazuh-documentation#10510 · opened

on Oct 26, 2026

5.0.0 docs - macOS CLI install writes the enrollment token world-readable to /tmp/wazuh_envs

wazuh/wazuh-documentation#10509 · opened

on Oct 26, 2026

5.0.0 docs - macOS agent install page lists only Sonoma/Sequoia and gives two different start commands

wazuh/wazuh-documentation#10508 · opened

on Oct 26, 2026

5.0.0 docs - A new 4.x agent needs the manager's enrollment password to enroll on a 5.0 manager, and no page says so

wazuh/wazuh-documentation#10507 · opened

on Oct 26, 2026

Documentation header search and footer toggle buttons have no accessible names

wazuh/wazuh-documentation#10466 · opened

on Oct 23, 2026

Windows agent guides still name the old OSSEC Start-menu folder and Manage Agent shortcut

wazuh/wazuh-documentation#10465 · opened

on Oct 23, 2026

Remote agent upgrade page doesn't say that agents earlier than 5.0 wait up to 15 minutes for the upgrade task

wazuh/wazuh-documentation#10463 · opened

on Oct 23, 2026

Email alerts: the CentOS install command of the SMTP relay fails on RHEL 9, which has no mailx package

wazuh/wazuh-documentation#10444 · opened

on Oct 21, 2026

1

Azure dependencies: the Python 3.12 to 3.13 pins do not load the 4.14 wodle, and the Yum branch cannot build cffi

wazuh/wazuh-documentation#10443 · opened

on Oct 21, 2026

1

IT hygiene: the ports table swaps local and remote, Traffic is not the listening ports, browser.name and the API list miss values, and four alert field examples lack their type

wazuh/wazuh-documentation#10441 · opened

on Oct 21, 2026

1

Puppet deployment: the password change leaves out vulnerability_indexer_password, shows dashboard_wazuh_api_credentials as a string, and the setup pages mix Puppet 7 and 8

wazuh/wazuh-documentation#10439 · opened

on Oct 21, 2026

2

SCA how it works: a Not applicable check has a result field in alerts and in the Server API, and no status field

wazuh/wazuh-documentation#10438 · opened

on Oct 21, 2026

1

macOS agent: the FIM defaults still name /etc, the Unified Logging block lacks sshd-session and sshd-auth, and successful sudo needs log_allowed on macOS 15 and later

wazuh/wazuh-documentation#10437 · opened

on Oct 21, 2026

1

Microsoft Graph: the sample alerts show the wrong rule and decoder, only_future_events also collects records older than the module start, and a malformed block logs errors, not a warning

wazuh/wazuh-documentation#10436 · opened

on Oct 21, 2026

1

Email alerts: the documented defaults of email_alert_level and email_log_source are the shipped ossec.conf values, and the rule 502 example sends no email

wazuh/wazuh-documentation#10435 · opened

on Oct 21, 2026

1

FIM proof of concept: changes made right after the Windows agent restart get no alert, because real-time monitoring starts only after the initial scan

wazuh/wazuh-documentation#10434 · opened

on Oct 21, 2026

1

Blocking a known malicious actor PoC: the sudo echo command that appends the attacker IP fails with Permission denied

wazuh/wazuh-documentation#10432 · opened

on Oct 21, 2026

1

Navigation Menu

Repository navigation

Issues

macOS ULS collection: the page says the agent uses --style syslog, but 4.14.10 agents on macOS 10.15 and later run the log tool with --style ndjson

Windows Registry `recursion_level`: the example says FIM alerts on `Subkey_3`, but with `recursion_level="3"` the agent stops at `level_3`

Solaris agent installation: error in the manager address configuration step

GCP posture management: the custom rules show an empty project name because the exported findings have no `resource.projectDisplayName`

Windows Registry `report_changes`: the documented value types are incomplete and differ between two pages

GCP dependencies: the documented steps do not give a working Google Cloud module on CentOS 7

Puppet deployment: the running `puppet` service can apply `stack.pp` before the Wazuh certificates exist, and that run fails

Agent from sources: the CentOS 6/7 steps fail with cmake not found, and Amazon Linux has no tab

AWS module docs: the agent dependency steps fail on Amazon Linux 2 and on Python 3.8, and the discard_regex example never matches

5.0.0 docs - macOS CLI install writes the enrollment token world-readable to /tmp/wazuh_envs

5.0.0 docs - macOS agent install page lists only Sonoma/Sequoia and gives two different start commands

5.0.0 docs - A new 4.x agent needs the manager's enrollment password to enroll on a 5.0 manager, and no page says so

Documentation header search and footer toggle buttons have no accessible names

Windows agent guides still name the old OSSEC Start-menu folder and Manage Agent shortcut

Remote agent upgrade page doesn't say that agents earlier than 5.0 wait up to 15 minutes for the upgrade task

Email alerts: the CentOS install command of the SMTP relay fails on RHEL 9, which has no mailx package

Azure dependencies: the Python 3.12 to 3.13 pins do not load the 4.14 wodle, and the Yum branch cannot build cffi

IT hygiene: the ports table swaps local and remote, Traffic is not the listening ports, browser.name and the API list miss values, and four alert field examples lack their type

Puppet deployment: the password change leaves out vulnerability_indexer_password, shows dashboard_wazuh_api_credentials as a string, and the setup pages mix Puppet 7 and 8

SCA how it works: a Not applicable check has a result field in alerts and in the Server API, and no status field

macOS agent: the FIM defaults still name /etc, the Unified Logging block lacks sshd-session and sshd-auth, and successful sudo needs log_allowed on macOS 15 and later

Microsoft Graph: the sample alerts show the wrong rule and decoder, only_future_events also collects records older than the module start, and a malformed block logs errors, not a warning

Email alerts: the documented defaults of email_alert_level and email_log_source are the shipped ossec.conf values, and the rule 502 example sends no email

FIM proof of concept: changes made right after the Windows agent restart get no alert, because real-time monitoring starts only after the initial scan

Blocking a known malicious actor PoC: the sudo echo command that appends the attacker IP fails with Permission denied