One problem on your own Wazuh, reproduced on your exact version. You get the change and the steps, you apply it on your system, and you pay only once it works there. If it doesn’t work, you owe nothing.
A rule or decoder that doesn’t fire, an agent, vulnerability detection, or one log source. For a silent rule we work out why — shadowed by a sibling rule that matches first, an event that never reaches the manager, no event that matches it, or a rule Wazuh dropped while loading — by replaying the events you send and reading the manager’s own log, not by reading rule IDs.
Alerts that never reach the indexer: mapper_parsing_exception in Filebeat, a field that is an
object in one event and a string in the next, documents dropped without a trace. You get the pipeline processor
and index template, tested on an indexer of your version against your event samples, with apply and rollback steps.
One fix for USD 49, in exchange for an anonymised write-up we can publish.
We agree the scope in one email: the problem, your Wazuh version, the samples. We deliver files and steps. When they work on your system — the rule fires on the replayed event, or the samples index with no mapping error on the next daily index — ATK sends the invoice (bank transfer or an online payment link). We never need write access to your systems.