Windows audit failure event.

Description

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 18100 Group of windows rules. anchor level 0
   Matches no fields of its own.
2. 18105 Windows audit failure event. anchor level 4 this rule
   Matches no fields of its own.

Rule dependencies

Depends on

• composes · Wazuh if_sid 18100
  • Group of windows rules.

Rule logic

Matches no fields of its own — an anchor that 12 rules refine. Deploying it alone raises nothing.