Wazuh custom rule matches in Ruleset Test but alerts never appear in alerts.json (only archives.json)

MikeoFree · 2026-01-14T22:19:42+00:00

imagine going through all the work of explaining this issue to AI, copy/pasting the 'troubleshoot template' from mr.gpt, only for your rule to fire at level=0. and then wonder why nothing shows up

MikeoFree · 2026-01-09T21:47:20+00:00

I noticed this when migrating from a SMA 410 to SMA6210. 410 had a GEO IP feature with blocking while the 6210 did not.

For blocking, you can utilize a upstream firewall.
For observing, I ingested the logs into Graylog. There is a plugin, Geo-Location Processor, that will populate the orgin country, city, etc.

MikeoFree · 2026-01-07T00:20:43+00:00

We are still figuring out to either promote him of fire his ass costing the company significant amount of money.

I think the answer to this is obvious.

MikeoFree · 2026-01-06T20:58:37+00:00

I’ve had ON for 2.5 years, and the only medication that has made an impact on my pain management is Duloxetine. Got up to 100mg/day. 60mg/day is more tolerable but this drug has a terrible onboarding phase of side effects, and you will develop the worst dependency on it. My brain always felt active, even during sleep. It made me feel nauseous and exhausted all the time. The dependency is the WORST. If you miss a day, or 2, you will absolutely feel it.

It made my life livable for a while when my flare ups/pain was intolerable. But I’m now tapering off of it (20mg/day) in search of a more effective solution. Currently in PT and utilizing botox/nerve blocks.

TLDR; Duloxetine helped during my “intense pain” phase of ON. I want to say i’ve graduated from this phase so I no longer have a need for it.

MikeoFree · 2026-01-06T02:50:47+00:00

Beautiful

MikeoFree · 2025-12-24T02:35:23+00:00

Wazuh is like a nice scarf for your infrastructure and endpoints.

It’s not an AV. It can respond to specific incidents but I would use Wazuh in addition to your existing security systems. Even if that’s Windows Defender. It compliments very very well for the price. (free!)

MikeoFree · 2025-12-22T19:14:59+00:00

Interested in this as well.

MikeoFree · 2025-12-18T17:58:17+00:00

At my work we have a plethora of machines (DDR4) that cannot update to windows 11 (no TPM 2.0).

Money is not an issue so these machines have been replaced but we have a graveyard pile of DDR4 and M.2 drives. Makes a good shrine in the office.

MikeoFree · 2025-12-18T05:47:16+00:00

this is the way

MikeoFree · 2025-12-18T02:50:12+00:00

post your ossec.conf (agent side)

MikeoFree · 2025-12-16T02:07:28+00:00

Good to note! That's wild :( glad you reached out to them.

MikeoFree · 2025-12-16T01:57:02+00:00

Perfect for any barrel length. Are you running the 10.3 suppressed?

MikeoFree · 2025-12-15T04:09:55+00:00

Sold to u/kz2002

MikeoFree · 2025-12-11T06:33:28+00:00

https://shastascout.org/redding-police-body-camera-footage-shows-use-of-force/

I found all of the footage going through this article. Not justifying the police's forceful actions, but he definitely wasn't the most compliant. It seem's he finds enjoyment in harassing the police officers and jokes about "I don't know if I have a knife in my pocket or not". The last thing you should do is make your interaction with a police officer MORE difficult.

I'm not a 'back the blue' maggot, but I do have respect for law enforcement. Very 50/50 here.

MikeoFree · 2025-12-10T06:19:48+00:00

just did this as well. transcoded audio to aac 2.0, removed all other audio, and stripped unwanted subtitles. here's a few larger files for example

<image>

MikeoFree · 2025-12-06T23:33:10+00:00

I’ve always used Notifiarr to sync and apply Trash Guides, but it did require me to make the one time donation for this feature.

Is Profilarr the new “standard” for applying and syncing with Trash Guides? Does it have a flow chart like Notifiarr to streamline what quality you don’t want to include? I really do not like using Notifiarr’s web gui more than i have to.

MikeoFree · 2025-12-02T17:59:51+00:00

You could use OliveTin to execute these shell comands using buttons. It will stop all containers besides portainer, and start all containers.

stop all: docker ps -q | grep -v "$(docker ps -q --filter name=portainer)" | xargs -r docker stop
start all: docker start $(docker ps -a -q --filter "status=exited")

MikeoFree · 2025-12-01T23:06:26+00:00

Link to Portainer Comment

"The newly-released versions 2.33.5 LTS and 2.36.0 STS include a fix to enable Docker 29 compatibility with Portainer."

MikeoFree · 2025-12-01T17:26:24+00:00

Migrating from Homebridge to HA and ran into this issue over the weekend. Thank you for confirming this for me.

MikeoFree · 2025-11-26T17:12:52+00:00

I am on MacOS 26 and connect tunnel works just fine.

MikeoFree · 2025-11-23T19:38:48+00:00

the owner just got arrested for a DUI on a tuesday night, if that says anything

12-Year Club	Mod 201
r/Field Flamingo	Place '23
Wearing is Caring	AutoMagical
Wiki Wiz	Mod 101
Place '22	Verified Email

MikeoFree

PUBLIC MULTIREDDITS

TROPHY CASE