# Verify decoding and rule matching for Wazuh command output > Separate receipt of Wazuh command output, decoded field extraction and a matching alert rule. Use the actual full_log content and the documented log-test workflow before accepting custom command monitoring. - Canonical URL: https://update.dsesecurity.com/updates/verify-decoding-and-rule-matching-for-wazuh-command-output/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-30T06:47:07+00:00 - Modified: 2026-10-30T06:47:29+00:00 - Last reviewed by DSE: 2026-10-30 - Resource type: Guide - DSE priority: Advisory - Topics: Cybersecurity, IT - Reading time: 3 minutes ## What you need to know Separate receipt of Wazuh command output, decoded field extraction and a matching alert rule. Use the actual full_log content and the documented log-test workflow before accepting custom command monitoring. ## Potentially affected Wazuh Command or Logcollector command-monitoring workflows that require a custom decoder or rule for their output. ## DSE recommendation DSE recommends testing a captured representative message through decoding and rule matching before accepting custom command-monitoring coverage. ## Article Bottom line: Define separate acceptance observations for the raw message, its decoded fields and the rule result. Do not close command monitoring merely because the command ran or its output reached the server. ## Source fact: documented behavior The [Command output analysis](https://documentation.wazuh.com/current/user-manual/capabilities/command-monitoring/command-output-analysis.html) guide describes pre-decoding, decoding and rule matching as separate processing stages for collected command output. The log-test utility displays decoding and rule matching, and the worked example initially reports no matching decoder. The worked example tests the actual full_log value, adds a decoder for its fields and then adds a rule to generate an alert from the decoded output. ## What the source does not establish This article tests interpretation of a representative command message. It does not authorize arbitrary endpoint command execution, validate the command’s business meaning or promise that a sample decoder handles every output format and unit. ## Applicability questions - Which approved command and representative raw output are in scope? - What fields and units must the decoder extract? - Which rule condition should produce the intended result? - What malformed or unrelated control must remain outside the match? ## DSE recommendation: controlled next steps The following steps are DSE recommendations based on the cited source. DSE recommends testing a captured representative message through decoding and rule matching before accepting custom command-monitoring coverage. - Obtain a harmless representative output through the approved endpoint process and preserve its exact raw message. Identify the fields and units the monitoring requirement actually needs. Keep a command-execution result separate from evidence that the message was received. Do not copy a memory example into an unrelated command’s decoder or invent an output that the deployed command has never been shown to produce. - Use the applicable log-test workflow to inspect the captured message before changing rules. Review extracted field names and values with the monitoring owner. If no decoder matches, investigate the raw format and intended decoder rather than increasing an alert level to conceal the parsing gap. Keep a slightly different or malformed test message as an explicit control with a written expected disposition. - After the decoding case is understood, review the rule that consumes those fields and test its intended condition separately. Preserve the existing custom decoder and rule definitions before a controlled change. For an authorized deployment, trace an actual new message through the same checkpoints and investigate any difference from the representative test rather than equating a successful configuration load with effective alerting. ## Verification and evidence Proposed verification: retain the representative raw message, the actual decoder observation and the separate rule result. Ask another operator to reconstruct which fields support the monitoring decision. Exercise the reviewed malformed or unrelated control and record whether it followed its intended path, without inventing console output or describing the source’s example as a DSE test. Compare any deployed alert’s identity and field values with the approved raw case through the normal access controls. Keep missing units, parsing differences and absent rule matches open for correction. No endpoint command, custom decoder, rule update or log-test execution was performed for this article; a later successful sample still needs its stated format boundary. ## Official references - [Command output analysis](https://documentation.wazuh.com/current/user-manual/capabilities/command-monitoring/command-output-analysis.html) — Wazuh; official product documentation. Source review completed October 30, 2026. Recheck the official source and deployment-specific applicability before changing production settings. ## Primary reference - Name: Wazuh — Command output analysis - Authority: documentation.wazuh.com - URL: https://documentation.wazuh.com/current/user-manual/capabilities/command-monitoring/command-output-analysis.html - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Verify decoding and rule matching for Wazuh command output,” DSE Security, https://update.dsesecurity.com/updates/verify-decoding-and-rule-matching-for-wazuh-command-output/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.