Eight samples, three decoders
Stock is ruleset/decoders/0285-snort_decoders.xml as shipped in 4.14.9. "Merged fix" is the three regex lines from PR #40521, which is merged for 4.14.11 but not released. "This page" is the same with one more change, shown below.
| sample (after the priority) | stock 4.14.9 | merged fix | this page |
|---|---|---|---|
{ICMP} 10.4.12.26 -> 10.4.10.231 | srcip 10.4.12 | dstip 10.4.10. | both correct |
{TCP} 10.4.12.26:37020 -> 10.4.10.231:162 | dstip 10.4.10.231:162 | correct | correct |
{UDP} 192.168.20.32 -> 192.168.20.2 | srcip 192.168.20 | correct | correct |
{TCP} 10.4.12.26:5000 -> 10.4.10.7 | correct | correct | correct |
{UDP} 10.4.12.26 -> 10.4.10.7:53 | srcip 10.4.12, dstip 10.4.10.7:53 | correct | correct |
{ICMP} 203.113.100.250 -> 198.51.100.200 | srcip 203.113.100 | dstip 198.51.100. | correct |
{TCP} 203.113.100.250:44321 -> 198.51.100.200:443 | dstip 198.51.100.200:443 | correct | correct |
[**] multi-line form from the file header | no fields | no fields | no fields |
Bold means wrong. The stock decoder got two of the seven snort: lines right, the merged fix five, this page all seven. The merged fix still loses the last octet of dstip when there is no destination port and that octet has three digits; we reported the measurement on the PR before 4.14.11 ships. The [**] form is assembled by the snort-full reader across several lines, which a single logtest line does not reproduce, so it is out of scope here.
Fix on 4.14.x today
1. Copy the stock file and change its three <regex> lines in the snort2 decoder to:
<regex>^[**] [(\d+:\d+:\d+)] \.+ (\d+.\d+.\d+.\d+)\p*\d* -> </regex>
<regex>(\d+.\d+.\d+.\d+)\p*\d*|^[(\d+:\d+:\d+)] \.+ </regex>
<regex>(\d+.\d+.\d+.\d+)\p*\d* -> (\d+.\d+.\d+.\d+)</regex>Save it as /var/ossec/etc/decoders/0285-snort_decoders-fixed.xml, owner wazuh:wazuh.
2. In /var/ossec/etc/ossec.conf, inside <ruleset>, stop the stock file from loading, so the two copies do not compete:
<decoder_exclude>ruleset/decoders/0285-snort_decoders.xml</decoder_exclude>3. Restart the manager. A new wazuh-logtest session picks the change up without a restart, so you can check first; live analysis needs the restart.
4. After upgrading to 4.14.11 or later, remove both again and re-run your samples: the shipped decoder may or may not include the dstip change above.
Limits. Measured with the logtest engine on 4.14.9, syslog snort: form only. Your snort output may differ (unified2 via barnyard, alert_fast, IPv6); run your own lines before you rely on it.
Check your own lines
Run your snort lines through wazuh-logtest before and after. Or let your AI agent run them on a real 4.14.9 manager through our MCP server: add https://atkvn.com/agent/mcp and ask it to test the decoder above against your lines (test_wazuh_rule). Note that the hosted test cannot change ossec.conf, so it shows the stock and local decoders side by side rather than the exclude. How to connect.