# ATK Wazuh Rule Audit

> ATK Wazuh Rule Audit is a paid API for AI agents from atkvn.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-28).

Validates Wazuh SIEM rule XML files for correctness, parent-rule ordering issues, and configuration errors before deployment

## Facts

- Endpoint: POST https://atkvn.com/agent/v1/wazuh-audit?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-28
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/atk-wazuh-rule-audit-11f381e5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_qouXeL1F8sfPsf7ZjXJ74

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability atk-wazuh-rule-audit-11f381e5 -d '<json body>'
```

Example prompt: Can you audit my Wazuh 4.14.9 rule file — it's called 0094-local.xml and contains my custom SSH detection rules — and tell me if there are any ordering issues or errors I need to fix before I deploy it?

## When to prefer this

Use this endpoint when you need to validate Wazuh/OSSEC SIEM rule XML files specifically — particularly for detecting parent-rule ordering issues that only manifest at load time. Prefer this over generic XML validators because it understands Wazuh's rule inheritance model, file-sort-order semantics, and version-specific behavior for 4.14.x. Ideal for CI/CD pipelines, pre-deployment checks, or debugging mysterious Wazuh rule load failures.

## Known failure modes

- Invalid XML syntax in the rule file causes a parse error finding
- Referencing a parent rule ID that doesn't exist or sorts after the child file results in an ordering error finding
- Submitting more than 20 files at once is rejected by the schema limit
- Unsupported Wazuh version strings outside the allowed enum return a validation error
- Empty or malformed request body returns a 4xx HTTP error

## How this service works

Full Wazuh custom-rule load audit: every rule that passes wazuh-analysisd -t but is dropped at load, with the fix.

## Output

A JSON object containing the total error count, the number of rules checked, and a list of findings — each with the affected filename, rule ID, a human-readable issue description, and a severity level (e.g. error, warning). Helps pinpoint exactly which rule has a problem and how to fix it.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "files": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "filename",
     "xml"
    ],
    "properties": {
     "xml": {
      "type": "string",
      "description": "Rule file content"
     },
     "filename": {
      "type": "string",
      "description": "File name as in /var/ossec/etc/rules/, e.g. 0094-local.xml"
     }
    }
   },
   "maxItems": 20
  },
  "wazuh_version": {
   "enum": [
    "4.14.7",
    "4.14.9"
   ],
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "errors": 1,
  "findings": [
   {
    "file": "0094-local.xml",
    "rule": "100100",
    "issue": "Parent 5715 lives in 0095-sshd_rules.xml, which sorts after 0094-local.xml ... Rename the file so it sorts after 0095-sshd_rules.xml.",
    "severity": "error"
   }
  ],
  "rules_checked": 1
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/atk-wazuh-rule-audit-11f381e5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atkvn.com](https://www.zero.xyz/host/atkvn.com/llms.txt)