# ATK Wazuh TestFire — Rule & Decoder Validation Engine

> ATK Wazuh TestFire — Rule & Decoder Validation Engine is a paid API for AI agents from atkvn.com, paid per call via x402, $0.008/call, status unknown (last checked 2026-10-28).

Submits raw log lines against custom Wazuh detection rules and decoders to verify which rules fire, at what level, and whether any rules are dropped or never matched

## Facts

- Endpoint: POST https://atkvn.com/agent/v1/wazuh-testfire?utm_source=zero.xyz
- Price: $0.008/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-28
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/atk-wazuh-testfire-rule-decoder-validation-engine-a0305aea
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_eLMbi6hcCSyqOw0URDNre

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability atk-wazuh-testfire-rule-decoder-validation-engine-a0305aea -d '<json body>'
```

Example prompt: I need to check whether my custom Wazuh rule fires correctly — here are 3 syslog lines from an SSH brute-force attempt and the XML rule file I wrote; run them through the Wazuh 4.14.9 engine and tell me which rule IDs triggered, at what level, and whether any rules were dropped or never matched.

## When to prefer this

Choose this endpoint when you need to validate custom Wazuh SIEM rules and decoders against real or synthetic log data before deploying to a live environment. It is specifically designed for Wazuh rule XML syntax and the Wazuh 4.14.9 engine — not generic regex testing or other SIEM platforms like Splunk or Elastic. Prefer this over standing up a test Wazuh instance when you need fast, repeatable, pay-per-call rule validation in an automated pipeline or CI workflow.

## Known failure modes

- Malformed XML in rule or decoder causes the rule to appear in 'your_rules_dropped_at_load' rather than returning an error
- Log lines that don't match any decoder result in no alert and empty decoder field
- Rules referencing undefined groups or fields silently fail to match
- Sending more than 10 log lines or 10 rules exceeds schema limits and will be rejected
- Specifying an unsupported Wazuh version (anything other than 4.14.9) returns a validation error
- Empty or whitespace-only log lines may produce unexpected decoder behavior

## How this service works

Run your Wazuh rules and decoders on a real wazuh-manager 4.14.9 against up to 10 log lines: did your rule fire, decoded fields, full alert, load warnings.

## Output

A JSON object containing an events array where each log line result includes whether an alert was triggered, the matched decoder name, the firing rule ID and level, and a flag for whether the user's specific rule fired. Also includes arrays of load warnings, rules that never matched any log, and rules that were dropped during loading — giving a complete picture of rule efficacy and correctness.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "logs": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "maxItems": 10,
   "minItems": 1,
   "description": "Raw log lines, one event each"
  },
  "rules": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "filename",
     "xml"
    ],
    "properties": {
     "xml": {
      "type": "string"
     },
     "filename": {
      "type": "string"
     }
    }
   },
   "maxItems": 10
  },
  "decoders": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "filename",
     "xml"
    ],
    "properties": {
     "xml": {
      "type": "string"
     },
     "filename": {
      "type": "string"
     }
    }
   },
   "maxItems": 5
  },
  "log_format": {
   "type": "string",
   "default": "syslog"
  },
  "wazuh_version": {
   "enum": [
    "4.14.9"
   ],
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "events": [
   {
    "alert": true,
    "decoder": "sshd",
    "rule_id": "100100",
    "rule_level": 10,
    "your_rule_fired": true
   }
  ],
  "load_warnings": [],
  "your_rules_never_matched": [],
  "your_rules_dropped_at_load": []
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/atk-wazuh-testfire-rule-decoder-validation-engine-a0305aea/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from atkvn.com](https://www.zero.xyz/host/atkvn.com/llms.txt)