affects · vulnerability.status = Active, vulnerability.severity = Critical

Description

$(vulnerability.cve) affects $(vulnerability.package.name)

Query · wazuh

field vulnerability.status="Active" AND field vulnerability.severity="Critical"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 23501 affects · vulnerability.cve = \.+ anchor level 0
    decoded_as=json AND field vulnerability.cve="\.+"
  2. 23506 affects · vulnerability.status = Active, vulnerability.severity = Critical refinement level 13 this rule
    field vulnerability.status="Active" AND field vulnerability.severity="Critical"

Rule dependencies

Depends on

Raw source affects · vulnerability.status = Active, vulnerability.severity = Critical · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="23506" level="13">
      <if_sid>23501</if_sid>
      <options>no_full_log</options>
      <field name="vulnerability.status">Active</field>
      <field name="vulnerability.severity">Critical</field>
      <description>$(vulnerability.cve) affects $(vulnerability.package.name)</description>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.