Rule Doctor Lite

About

Rule Doctor Lite is a read-only Python script for Wazuh 4.x that lists custom rules that never fired and gives the most likely reason, including rules Wazuh silently drops while loading. It uses only the standard library, reads files without changing the manager, and sends nothing over the network. This helps detection engineers find rules that appear deployed but provide no coverage.