On the cybrary@ubuntu tab, execute sudo systemctl restart wazuh-manager.service to restart the Wazuh manager service.
getting error here
without the restart custom rule won’t take effect.
That happens when there is an error in the rule.
Can you post a screen shot of your local rule?
oh yeah ! made a mistake i overlooked <group/> in custom rule. pasted my custom rule outside of it. all sorted.
1 Like