Pre-match rule for kernel messages.

Description

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 5100 Pre-match rule for kernel messages. anchor level 0 this rule
   Matches no fields of its own.

Rule logic

Matches no fields of its own — an anchor that 22 rules refine. Deploying it alone raises nothing.