The current Wazuh ruleset documentation needs an update to clarify how the time and weekday options evaluate events based on the timestamp. It should be explicitly stated that these options use the timestamp from the moment the event is processed by the manager, not the timestamp embedded within the event itself. This clarification will help users understand the operational context of these options and prevent potential confusion about their functionality.
Objectives:
Clarify that the time option checks whether the event was generated within a specific time range based on the manager's system time when the event is evaluated.
Specify that the weekday option determines if an event occurs on particular days of the week based on the manager's system time at the moment of evaluation.
Tasks:
Documentation Update: Amend the sections that describe the time and weekday options in the Wazuh ruleset documentation.
Technical Review: Ensure that the updated descriptions accurately reflect the implementation and usage of these options.
Consistency Check: Review other parts of the documentation to ensure consistency in how time-related options are described across the board.
Expected Outcome:
The documentation accurately describes how time and weekday options are evaluated, providing clear guidance to users on their usage.
Increased clarity in documentation leads to better understanding and fewer misconfigurations by users.
DoD (Definition of Done):
[ ] The time and weekday sections are updated to include the new clarifications.
[ ] Technical accuracy confirmed by the Wazuh technical team.
[ ] Documentation is consistent and clear across all related sections.
This update will ensure users have the correct understanding of how timing conditions are applied within Wazuh rules, leading to more effective and accurate configurations.
Description:
The current Wazuh ruleset documentation needs an update to clarify how the
time
andweekday
options evaluate events based on the timestamp. It should be explicitly stated that these options use the timestamp from the moment the event is processed by the manager, not the timestamp embedded within the event itself. This clarification will help users understand the operational context of these options and prevent potential confusion about their functionality.Objectives:
time
option checks whether the event was generated within a specific time range based on the manager's system time when the event is evaluated.weekday
option determines if an event occurs on particular days of the week based on the manager's system time at the moment of evaluation.Tasks:
time
andweekday
options in the Wazuh ruleset documentation.Expected Outcome:
time
andweekday
options are evaluated, providing clear guidance to users on their usage.DoD (Definition of Done):
time
andweekday
sections are updated to include the new clarifications.This update will ensure users have the correct understanding of how timing conditions are applied within Wazuh rules, leading to more effective and accurate configurations.