Ignore snap disks because they are always at 100% of capacity

Description

Ignore snap disks because they are always at 100% of capacity

Query · wazuh

regex="'df -P':\s+/dev/loop\d+\s+\d+\s+\d+\s+0\s+100%\s+/snap/\w+/\d+"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 500 Grouping of wazuh rules. anchor level 0
    decoded_as=ossec
  2. 530 Wazuh process monitoring rules. anchor level 0
    match="^ossec: output:"
  3. 531 Partition usage reached 100% (disk space monitor). anchor level 7
    match="ossec: output: 'df -P': /dev/" AND regex="100%"
  4. 536 Ignore snap disks because they are always at 100% of capacity suppression level 0 this rule
    regex="'df -P':\s+/dev/loop\d+\s+\d+\s+\d+\s+0\s+100%\s+/snap/\w+/\d+"

Rule dependencies

Depends on

Raw source Ignore snap disks because they are always at 100% of capacity · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="536" level="0">
    <if_sid>531</if_sid>
    <regex>'df -P':\s+/dev/loop\d+\s+\d+\s+\d+\s+0\s+100%\s+/snap/\w+/\d+</regex>
    <description>Ignore snap disks because they are always at 100% of capacity</description>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.