analyst@alrasedah:~$ sudo vim /var/ossec/etc/rules/local_rules.xml

<group name="local,syslog,sshd,">

  <!-- SSH brute force: 8 failed logins from one source in 120s -->
  <rule id="100210" level="10" frequency="8" timeframe="120">
    <if_matched_sid>5710</if_matched_sid>
    <same_source_ip />
    <description>SSH brute force from $(srcip)</description>
    <mitre><id>T1110</id></mitre>
  </rule>

  <!-- Web: probing for exposed admin panels and secrets -->
  <rule id="100240" level="12">
    <if_group>web|attack</if_group>
    <url>/wp-login.php|/.env|/actuator</url>
    <description>Sensitive path probing detected</description>
  </rule>

  <!-- Cloud: privileged role granted outside the change window -->
  <rule id="100270" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">iam.role.grant</field>
    <description>Privileged role granted - review required</description>
  </rule>

</group>

analyst@alrasedah:~$ wazuh-logtest -q < sample.log
**Phase 3: Completed filtering (rules).
Rule: 100210 level 10 -> 'SSH brute force from 203.0.113.44'