Puppet ran in the last 30 minutes

Description

match="Puppet: OK"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 500 Grouping of wazuh rules. anchor level 0
   decoded_as=ossec
2. 530 Wazuh process monitoring rules. anchor level 0
   match="^ossec: output:"
3. 80090 Command check if puppet runs every 30 min or less anchor level 0
   match="^ossec: output: 'timestamp_puppet"
4. 80091 Puppet ran in the last 30 minutes suppression level 0 this rule
   match="Puppet: OK"

Rule dependencies

Depends on

• composes · Wazuh if_sid 80090
  • Command check if puppet runs every 30 min or less