View source for Supressing alerts based on rule id in Wazuh

[[Main Page | Home]] > [[Wazuh]] > [[Supressing alerts based on rule id in Wazuh]]

= Suppressing Wazuh Alert with Rule ID =

== Overview ==
This guide explains how to suppress a specific Wazuh alert triggered by '''rule ID 60608 (Example)'''. This is useful when the alert is a known false positive or low-severity event that does not require action.

== Step-by-Step Instructions ==

=== 1. Confirm the Rule ID ===
Check the rule.id field of alert generated in Wazuh Dashboard :
<pre>
rule.id:60608
</pre>

=== 2. Edit the Local Rules File ===
Open the following file for editing in Wazuh Manager Node:
<pre>
/var/ossec/etc/rules/local_rules.xml
</pre>

Append the suppression rule:
<pre><nowiki>
<group name="custom-suppression">
  <rule id="110608" level="0">
    <if_sid>60608</if_sid>
    <description>Suppressing alert with rule ID 60608 (known false positive)</description>
  </rule>
</group>
</nowiki></pre>

=== 3. Restart Wazuh Manager ===
Apply the changes by restarting the manager:
<pre>
sudo systemctl restart wazuh-manager
</pre>

=== 4. Validate Suppression ===
Verify that alerts with rule ID 60608 are no longer generated in the Wazuh dashboard or alert logs.

== Notes ==
* `id="110608"` is a unique local or custom rule ID.
* `level="0"` disables the alert.
* Always ensure that suppression does not hide important alerts.