Wazuh custom rules silently fail when file names sort before parent rule files

·5 views

A subtle but impactful bug in Wazuh 4.14.7 causes custom child rules to silently fail when their containing file is loaded before the file holding the parent rule, due to alphabetical merge ordering. Unlike a typical misconfiguration, the issue produces only warnings — not errors — meaning the config check command wazuh-analysisd -t exits with code 0, giving deploy scripts a false all-clear. Testing on a containerised Wazuh manager confirmed that files named to sort after the parent's file, such as local_rules.xml or any prefix above the parent's file number, load correctly and fire as expected. Administrators can detect affected rules by grepping manager logs or analysisd output for warning codes 7617 and 7619, which identify rules whose parent IDs were not yet loaded. The recommended fix is to place child rules in local_rules.xml or in a file whose name sorts alphabetically after the file containing the parent rule.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

No Single Tool Can Reliably Detect AI Hallucinations, Studies Find

Recent research confirms that no single method is universally effective at detecting hallucinations in AI-generated content. Hallucination detection refers to the automated identification of AI outputs that are factually incorrect or unsupported by provided context. Experts now recommend treating detection as a layered workflow rather than relying on any one tool. This combined approach should integrate source checking, knowledge graphs, model behaviour analysis, and internal signals alongside human review. The findings highlight the growing complexity of ensuring factual accuracy in long-form AI responses.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

ZoomEye Data Reveals Scale of Exposed Juniper, Sophos, WatchGuard and Barracuda Devices

A cybersecurity analysis published on DEV Community used the ZoomEye search engine to measure internet-facing appliances from four major edge security vendors on 26 September 2026. Juniper led with 342,558 exposed devices, followed by Barracuda at 164,282, WatchGuard at 31,364, and Sophos at 19,609, though the Juniper figure is not directly comparable as it spans a broader product portfolio beyond firewalls. All three remaining vendors primarily serve small and mid-sized businesses and have each experienced notable remote access vulnerabilities in recent years. The analysis cautions that these figures likely undercount total deployments, since many administrators deliberately obscure device banners, meaning the data reflects organizations that have not actively hidden their presence. Security experts recommend that appliance owners verify firmware versions directly on devices, confirm whether management interfaces are publicly accessible, and subscribe to each vendor's advisory channel to stay current on patches.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Bill of Materials Module for Your Android Library

A Bill of Materials (BOM) allows Android developers to declare a single version in their build file and receive a set of libraries guaranteed to work together, eliminating version-compatibility guesswork. While developers routinely consume BOMs like Firebase or Jetpack Compose, creating one for a multi-module library is far less common but surprisingly simple. The foundation of any BOM is Maven coordinates — a Group ID, Artifact ID, and Version (GAV) — which uniquely identify every library published to a Maven repository. A BOM itself is defined using a POM (Project Object Model) XML file, which describes library metadata and dependencies without requiring any source code or compiled binaries. Understanding how POM files map to GAV coordinates is the key first step toward publishing a custom BOM for library consumers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

TypeSafe Launches Jev, an AI Model Built for Fast Structured Decisions

TypeSafe has released Jev, which it calls a 'System One Model' — an AI designed to return fast, structured decisions rather than generate open-ended text responses. The concept borrows from psychologist Daniel Kahneman's framework of fast versus deliberate thinking, positioning Jev as a decision engine rather than a general-purpose language model. Developers feed Jev an application state and a set of typed questions, and the model returns structured outputs such as yes/no probabilities, ranked choices, or scores — all evaluable in parallel. TypeSafe claims end-to-end response times of 70–500 milliseconds and an input-token price of $0.042 per million tokens, though these figures are vendor-reported and not independently verified. The launch has sparked developer interest in hybrid AI architectures where models like Claude handle reasoning and generation while Jev handles discrete, time-sensitive decision points within application logic.

0 comments Read more at DEV Community