Tool proficiencyΒΆ
Weapons and warrants: the specific incantations of the Wazuh Rule. Become a clerk of chaos, writing decoders to force sense from the gibberish of a Sysmon report, crafting precise <rule> declarations to define a crime, and using <if_sid> to link related misdeeds. This is the granular craft of turning a single, strange event at the Mended Drum into a formal alert for the attention of the Dept of Silent Stability.