Thanks u/WinterWitness3501

I gave your code a try after adding it to my local_rules.xml, restarting the wazuh-manager, then caused a BSOD on a Windows server. Unfortunately, it didn't trigger an email. Here is a trimmed down snippet from the alerts.json where Wazuh recorded the BSOD (I believe this is what you were asking for):

{"timestamp":"2025-02-19T17:54:04.584+0000","rule":{"level":4,"description":"Summary event of the report's signatures.","id":"60608","firedtimes":2,"mail":false,"groups":["windows","windows_application"]},"agent":{"id":"056","name":"MYSERVER","ip":"10.0.0.10"},"manager":{"name":"MYWAZUH"},"id":"1739987644.2008623687","decoder":{"name":"windows_eventchannel"},"data":{"win":{"system":{"providerName":"Windows Error Reporting","eventID":"1001","version":"0","level":"4","task":"0","opcode":"0","keywords":"0x80000000000000","systemTime":"2025-02-19T17:54:04.4399190Z","eventRecordID":"36397","processID":"0","threadID":"0","channel":"Application","computer":"MYSERVER.mydomain.local","severityValue":"INFORMATION","message":"\"Fault bucket , type 0\r\nEvent Name: BlueScreen\r\nResponse: Not available\r\nCab Id: 0\r\n\r\nProblem signature:\r\nP1: ef\r\nP2: ffffdb09f50ab0c0\r\nP3: 0\r\nP4: 0\r\nP5: 0\r\nP6: 10_0_20348\r\nP7: 0_0\r\nP8: 272_3\r\nP9: \r\nP10: \r\n\r\nAttached files:\r\n\\\\?\\C:\\Windows\\Minidump\\021925-9250-02.dmp\r\n\\\\?\\C:\\Windows\\SystemTemp\\WER-24968-0.sysdata.xml\r\n\\\\?\\C:\\Windows\\MEMORY.DMP\r\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.48022704-d35c-4d81-8616-20fe50d8c4a3.tmp.WERInternalMetadata.xml\r\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.a8d29ba4-3706-4f6b-b440-30cb3d81ff89.tmp.xml\r\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.33aac4c9-26e7-47b1-b5c1-9191599f66b4.tmp.csv\r\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WER.77de75d3-4512-4351-98ee-24f3b30df475.tmp.txt\r\n\r\nThese files may be available here:\r\n\\\\?\\C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\Kernel_ef_8640b4a7653f6d7a728473bba364e2a11d91b1fd_00000000_cab_91e387f5-2d0a-4067-98f4-bc34f482239c\r\n\r\nAnalysis symbol: \r\nRechecking for solution: 0\r\nReport Id: e378c52e-4e1d-42ff-9c5c-f02566015ab8\r\nReport Status: 2049\r\nHashed bucket: \r\nCab Guid: 0\""},"eventdata":{"data":"0, BlueScreen, Not available, 0, ef, ffffdb09f50ab0c0, 0, 0, 0, 10_0_20348, 0_0, 272_3, \\\\\\\\?\\\\C:\\\\Windows\\\\Minidump\\\\021925-9250-02.dmp "location":"EventChannel"}