Defining an alert level threshold
Every posible event on the Wazuh Agent is set with certain level, by default is 1, all events from this level will trigger and alert into Wazuh Manager.
Configuration
All configuration of Remote Service is done via ossec.conf
using <alerts>
XML tag, all the available options are detailed in Alerts reference
<ossec_config>
<alerts>
<log_alert_level>6</log_alert_level>
</alerts>
</ossec_config>
This will set to level 6 the minimum severity level for alerts to be stored to alerts.log and/or alerts.json.
When you change any value on ossec.conf
file, you need to restart the service to enabling previously changed values.
For Systemd:
# systemctl restart wazuh-manager
For SysV Init:
# service wazuh-manager restart