# ATK New Technology > ATK New Technology (Hanoi, Vietnam) builds instruments that measure whether security tooling actually does what people assume: whether a SIEM rule fires, whether an attack technique raises an alert, which cryptography is really negotiated on the wire. Every figure on atkvn.com is measured on ATK's own bench and published with its method and limits. Contact: support@atkvn.com (Dong Nguyen, founder). Code: https://github.com/xuxu298. Articles: https://dev.to/xuxu298. ## Wazuh fix notes (step-by-step, each with a one-minute check, measured on Wazuh 4.14.7) - [Wazuh rule dropped at load: 7617 and 7619, analysisd -t exits 0](https://atkvn.com/fix-rule-dropped-at-load-7617-7619.html): a child rule in a file that sorts before its parent's file is ignored at load; files in etc/rules load mixed with ruleset/rules by file name. - [Wazuh rule matches in wazuh-logtest but never fires](https://atkvn.com/fix-rule-passes-logtest-but-never-fires.html): five measured causes, including restarts resetting frequency counters, events lost before the manager, and being the agent name for agent events. - [Wazuh rule shadowed by a sibling rule](https://atkvn.com/fix-rule-shadowed-by-sibling.html): children of one parent are evaluated by level, then load order; which fix to use. - [mapper_parsing_exception: alert in alerts.json but not in the dashboard](https://atkvn.com/fix-mapper-parsing-exception.html): a field that is an object in some events and a string in others (e.g. data.ms-graph.status); two measured fixes. - [Wazuh rule with matches in logtest but never fires for agent events](https://atkvn.com/fix-hostname-rule-never-fires-for-agent-events.html): for events from an agent, is compared with the agent name, not the syslog host shown in the alert; test with wazuh-logtest -l '[id] (agent) ip->location'. - [Cannot read 'srcip' from data](https://atkvn.com/fix-cannot-read-srcip-from-data.html): what Wazuh active response reads and in what order (from the 4.14.7 source). - [PHP2Shell (CVE-2026-109618/109619): stock Wazuh does not alert on PHP-FPM crashes or out-of-memory floods](https://atkvn.com/fix-wazuh-php2shell-crash-and-oom-signals.html): on 4.14.9 a PHP-FPM worker killed by SIGSEGV is not decoded and repeated PHP out-of-memory fatals from one client stay at level 0 or 5; one decoder and eight rules, tested. Free agent check: MCP tool check_php2shell or POST https://atkvn.com/agent/v1/php2shell with php -v / php -i / os-release / dpkg output. - [usermod adding a user to sudo, and MySQL or MariaDB access denied, raise no alert](https://atkvn.com/fix-wazuh-usermod-sudo-and-mysql-access-denied-no-alert.html): on 4.14.9 usermod group changes have no decoder, mysqld Access denied lands on level 0 and mariadbd on level 2; tested local decoder and four rules. - [snort decoder cuts the last octet off srcip and dstip](https://atkvn.com/fix-wazuh-snort-srcip-truncated-last-octet.html): 4.14.x stores 10.4.12.26 as 10.4.12 when the source has no port; the fix merged for 4.14.11 still cuts some dstip values; local decoder correct on seven samples. ## For AI agents (MCP server + x402 API) - [ATK Security Checks](https://atkvn.com/agent/): remote MCP server at https://atkvn.com/agent/mcp (official MCP Registry: com.atkvn/security-checks). Tools: check_post_quantum_tls and check_tls_certificate (free, one TLS handshake, public hostnames only), audit_wazuh_rules (static load-order audit; free preview), test_wazuh_rule (runs rules, decoders and log lines on a real wazuh-manager 4.14.9: did your rule fire, load warnings 7617/7619; free for one line). Paid per call by x402 in USDC on Base, no account: full Wazuh audit USD 0.05, full rule test USD 0.008 for up to 10 lines, TLS batch of 10 hostnames USD 0.005. OpenAPI: https://atkvn.com/openapi.json. ## Free tool - [ATK Rule Doctor Lite](https://github.com/xuxu298/rule-doctor-lite): free, read-only, one Python 3 file (Apache-2.0). Lists every custom Wazuh rule that never fired and the likely reason: DROPPED-AT-LOAD (including chains of dropped rules), SHADOW-CANDIDATE, NEVER-REACHES-MANAGER (only loss that raised rule 203/204), NO-MATCH. Tested on a real Wazuh 4.14.7 manager. Install: `pipx install rule-doctor-lite` (or `pip install rule-doctor-lite`) (https://pypi.org/project/rule-doctor-lite/) or download the single file from the latest GitHub release. ## Paid - [ATK Rule Doctor for Wazuh](https://vct.atkvn.com/rule-doctor.html): software, USD 490 per Wazuh cluster per year. Confirms shadowed rules by replay on a throwaway manager and fixes mapper_parsing_exception mapping conflicts. - [Wazuh Fix](https://vct.atkvn.com/#fix): one Wazuh problem (a rule, decoder, agent, vulnerability detection or one log source) reproduced and fixed on your exact version, USD 149 fixed; an indexer mapping or deployment problem, USD 490 fixed. Paid only after it works on your system, by bank transfer or an online payment link (cards accepted), invoiced by ATK. First three customers: USD 49 for one fix, in exchange for an anonymised write-up. Also on Upwork. - [VCyber Twin](https://vct.atkvn.com/): breach and attack simulation on a digital twin; replays ATT&CK techniques against a twin of the customer stack and records what fired, what stayed silent and how long each took. Per monitoring environment (one SIEM and its log sources): Detection Runner free (customer runs it, read-only, Wazuh); Detection Baseline USD 490; Coverage Page USD 2,400; Gap Closure USD 6,000 (measure, close five gaps, re-run); Quarterly re-run USD 1,800 per quarter; VCyber Twin Appliance on-prem USD 14,000 per year. Invoiced by ATK, bank transfer. VCyber Range training (https://vct.atkvn.com/range.html) is included with the Appliance on pilot terms. - [VPQ Audit](https://vpqaudit.atkvn.com/): post-quantum readiness measured from the wire; CycloneDX CBOM output. Pilot. Priced per scope. - [VRadar](https://vradar.io): autonomous SOC for companies without a security team. In production. ## Research - [Research index](https://atkvn.com/research.html) - [Detection Evidence Map, 84 ATT&CK techniques](https://atkvn.com/detection-evidence-map-84-techniques.html): per-technique evidence records; data in JSON and CSV. - [Detection Reality Index Vol.1](https://atkvn.com/detection-reality-index-vol1.html): 24 ATT&CK techniques replayed against a default SIEM install; three raised an alert. - [Detection Reality Index Vol.2, IBM QRadar](https://atkvn.com/detection-reality-index-vol2-qradar.html) - [Detection Reality Index Vol.3, the between-audit gap](https://atkvn.com/detection-reality-index-vol3-between-audits.html) - [Crypto Reality Index Vol.2 — banks](https://atkvn.com/crypto-reality-index-vol2-banks.html): public websites of 2,516 banks in 50 countries; 993 of 2,244 clear results negotiate hybrid post-quantum key exchange (44%), Germany 45 of 612. Anonymised rows published as CSV. - [Crypto Reality Index Vol.1](https://atkvn.com/crypto-reality-index-vol1.html): we offered hybrid post-quantum key exchange to 45 public endpoints and recorded what each negotiated; 20 declined it. Includes a published correction. - [Position paper, IETF/IAB post-quantum authentication workshop](https://atkvn.com/iab-pq-workshop-2026-position-paper.html) ## Optional - [How to work with ATK](https://atkvn.com/how-to-work-with-us.html) - [Request a demo](https://atkvn.com/demo.html)