Grouping for the mptscrih rules.

Description

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 5100 Pre-match rule for kernel messages. anchor level 0
   Matches no fields of its own.
2. 2935 Grouping for the mptscrih rules. anchor level 0 this rule
   Matches no fields of its own.

Rule dependencies

Depends on

• composes · Wazuh if_sid 5100
  • Pre-match rule for kernel messages.

Rule logic

Matches no fields of its own — an anchor that 1 rule refines. Deploying it alone raises nothing.