sigma_to_wazuh icon indicating copy to clipboard operation
sigma_to_wazuh copied to clipboard

Published 20 hours ago • verified publisher icon theflakes

ERROR: (1226): Error reading XML file 'etc/rules/sigmano18702.xml': XMLERR: String overflow. (line 18702).

Open tongsak2543 opened this issue 10 months ago • 3 comments

pls,help me ERROR: (1226): Error reading XML file 'etc/rules/sigmano18702.xml': XMLERR: String overflow. (line 18702). image image

tongsak2543 avatar Apr 19 '24 09:04 tongsak2543

Rule is probably too much for wazuh, you'll need to either not use that rule, break it into a couple rules, or use a CDB file, see: https://documentation.wazuh.com/current/user-manual/ruleset/cdb-list.html

theflakes avatar Apr 19 '24 13:04 theflakes

The other option is to add the Sigma rule ID to the ini config to skip it.

theflakes avatar Apr 19 '24 23:04 theflakes

Got it. Thank you very much.

tongsak2543 avatar Apr 22 '24 03:04 tongsak2543