Zone has been removed from a master server

Description

Zone has been removed from a master server

Query · wazuh

regex="zone \S+: \(master\) removed"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 12100 Grouping of the named rules anchor level 0
    decoded_as=named
  2. 12121 Zone has been removed from a master server suppression level 1 this rule
    regex="zone \S+: \(master\) removed"

Rule dependencies

Depends on

Raw source Zone has been removed from a master server · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="12121" level="1">
    <if_sid>12100</if_sid>
    <regex>zone \S+: \(master\) removed</regex>
    <description>Zone has been removed from a master server</description>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.