Kernel usbhid probe error (ignored).

Description

match="usbhid: probe of"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 5100 Pre-match rule for kernel messages. anchor level 0
   Matches no fields of its own.
2. 5112 Kernel usbhid probe error (ignored). suppression level 0 this rule
   match="usbhid: probe of"

Rule dependencies

Depends on

• composes · Wazuh if_sid 5100
  • Pre-match rule for kernel messages.