Rule Doctor Lite
github.com/xuxu298/rule-doctor-lite- Category
- Cybersecurity
- Rank
- No. 3947Tools index
Previous survey · No. 3790 ·
- Pricing
- Open Source
- Type
- TOOL
- Use case
- Security & Identity
- GitHub
- 1 stars
- Latest release
- v0.2.4
- Date
About
Rule Doctor Lite is a read-only Python script for Wazuh 4.x that lists custom rules that never fired and gives the most likely reason, including rules Wazuh silently drops while loading. It uses only the standard library, reads files without changing the manager, and sends nothing over the network. This helps detection engineers find rules that appear deployed but provide no coverage.
At a glance
Rule Doctor Lite checks Wazuh files and logs to help explain why a custom rule did not fire. It is worth trying when you need to distinguish a rule that was dropped during loading from one that simply did not match.
Good fit
Operators investigating custom Wazuh 4.x rules using an approved local copy of the relevant files.
Consider something else when
Use a controlled event replay when you need proof that a fixed rule catches a particular event.
Start here
Scan a sanitized fixture with one deliberately broken rule. Compare the reported cause with the manager log and verify the correction in a test environment.
Cost and requirements
Free Python 3 utility using the standard library. It accepts a copy of the relevant manager rules and logs.
Limits to know
The diagnosis depends on the files and alert history available. A likely reason does not prove that a corrected rule works against real events.
Sources checked 2026-11-05. Source-based assessment.
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.