diff --git a/README.md b/README.md index 9c48c1e..ada8324 100644 --- a/README.md +++ b/README.md @@ -11,10 +11,9 @@

Key Features • - How To Use • - What are the tests? • - Organizing Tests • - Test Syntax • + Quickstart • + Private Setup • + Decoder Resolution • Related • License

@@ -33,6 +32,9 @@ * Prevent Regression +* Decoder Confligt Resolution + - Automatically disables default decoders that overlap with custom decoders. + ## Quickstart (Public) 1. Fork this repository and only copy the main branch @@ -108,6 +110,45 @@ >**Note:** If this step is failing ensure that the account you are using has proper access to the new repository. +## Decoder Resolution + +If a custom decoder name overlaps with an default Wazuh decoder's name, the Wazuh manager will fail to startup. To address this, this pipeline will automatically disable default decoder names that overlap/conflict with custom decoders names. + +This can be useful, but it can also break detection logic as the pipeline will exclude entire default decoder files when any conflict with a custom decoder file is detected. + +**Example:** + +You add the custom [auditd](https://www.redhat.com/sysadmin/configure-linux-auditing-auditd) decoder below to the `decoders/` folder in this pipeline. + +`custom_auditd_decoder.xml` contents: + +```xml + + My Special Custom Pattern + +``` + +The pipeline scripts will find an overlapping default decoder `0040-auditd_decoders.xml` and disable the entire file. This is because both files contain a decoder with the name `auditd`. As a result of being in the same file, the decoder `auditd-syscall` will also be disabled. + +`0040-auditd_decoders.xml` contents: + +```xml + + ^type= + + + + auditd + ^SYSCALL + ^(SYSCALL) msg=audit\(\d\d\d\d\d\d\d\d\d\d.\d\d\d:(\d+)\): + audit.type,audit.id + + +(...) +``` + +Because of this behavior, it is recommended that when you are modifying default decoders copy the entire original decoder file and make the modifications inside of the copy. + ## Related [wazuh-pipeline](https://github.com/alexchristy/wazuh-pipeline) - Wazuh CI pipeline that leverages this tool