Read this first.
- All findings come from Wazuh 5.0.0-rc1 in our test container (10/10/2026), not the 5.0.0 GA release. GA may change any of this.
- The page does pattern matching on your XML. It does not run Wazuh.
- Wazuh's 5.x migration guide says custom 4.x XML rules and decoders cannot be migrated to Wazuh 5.x (transition plan).
One box per file. Rules and decoders can be in the same box or in separate boxes.
Nothing is uploaded. The check runs in this tab.
What each finding means
| Code | Applies to | What we saw on 5.0.0-rc1 |
|---|---|---|
| R1 | every rule and every decoder | Not loaded as-is. On 5.0.0-rc1 the XML ruleset format has no load path: our 4.x local_rules.xml/local_decoder.xml dropped into etc/rules and etc/decoders produced zero log lines and the config check still returned success. Needs a rewrite (Sigma rule / 5.0 decoder) via the Content Manager. |
| R2 | rules with frequency, timeframe, same_* / different_*, if_matched_sid, if_matched_group | No working path found in our test. A Sigma aggregation rewrite saved (201) but creating its detector failed (HTTP 500, NullPointerException); Sigma correlation syntax (event_count / group-by / timespan) was rejected with 400; a correlation rule saved but produced zero correlations. Treat as: keep on 4.x / re-design. |
| R3 | child rules (if_sid, if_group) | Parent and child both fire. Rewritten as Sigma on rc1, the parent and child both produced findings on the same event; in 4.x only the child alerts. Expect duplicate findings unless you exclude the child condition from the parent (we did not test that exclusion). |
| R4 | rules that use 4.x field names (<field name="X">, $(X) in the description, <srcip>, <dstip>, <user>, <srcport> and similar) | Field names change. In our test 5.0.0-rc1 rejected a 4.x field name, for example srcip: The following fields are not part of the Wazuh Common Schema (WCS): [srcip]. We did not test every field. Names we measured on the same log line: see the table below. For any other field the page says “5.0 name not measured by us”. |
| R5 | every rule with a numeric level | Numeric level → pick a word level. 5.0 levels are words (informational / low / medium / high / critical); a numeric "10" was rejected (SigmaLevelError). We do not suggest a number-to-word mapping. |
| R6 | rules with <list> (CDB lookup) | CDB lists → KVDB in 5.0; conversion not measured by us. |
| D1 | decoders with <parent> | Cannot be a child of a standard decoder. A custom decoder cannot be a child of a standard decoder on rc1 (The root decoder ... cannot have parents); it has to be rewritten as a root decoder that parses the syslog header itself. |
| D2 | every decoder | Unclassified events are not indexed. Events no decoder classifies are not indexed: index_unclassified_events defaults to false; in our test 4 of 16 lines never reached the index. |
Field names we measured (same log line, 4.14.7 vs 5.0.0-rc1)
| 4.x name | 5.0.0-rc1 name |
|---|---|
srcip | source.ip |
srcport | source.port |
srcuser | user.name |
dstuser | user.name (same field as srcuser) |
program_name | process.name |
hostname | host.hostname |
full_log | event.original |
How we checked it
On 10/10/2026 we ran wazuh/wazuh-manager:4.14.7 as a baseline and wazuh/wazuh-manager:5.0.0-rc1 with wazuh/wazuh-indexer:5.0.0-rc1 in temporary Docker containers, with one set of custom 4.x rules and decoders and 16 SSH and application log lines. On 4.14.7 that set loaded and fired in wazuh-logtest. On 5.0.0-rc1 we tried to load the XML as it was, then rewrote the rules and decoders through the Content Manager and fed the same 16 lines in. Each finding in the table above is something we saw in that run.
- All findings come from Wazuh 5.0.0-rc1 in our test container (10/10/2026), not the 5.0.0 GA release. GA may change any of this.
- The page does pattern matching on your XML: it looks for the elements and attributes listed above. It does not run Wazuh, and it does not know whether your rules would have fired.
- Wazuh's 5.x migration guide says custom 4.x XML rules and decoders cannot be migrated to Wazuh 5.x: documentation.wazuh.com/5.0-rc/migration-to-5x/transition-plan.html.
- Our test container is not a production install: the indexer ran with the security plugin off, and events were pushed straight into the engine, not through a real agent.
Not measured
- Wazuh 5.0.0 GA.
plugins.security_analytics.auto_correlations_enabled=true(it isfalseby default on rc1).- Correlation between two standard integrations.
- Converting CDB lists to KVDB and looking them up from a rule.
If the page says “not measured by us”, we have no result for it, good or bad.