Events
Events are raw logs and security records collected by Wazuh agents and other log sources. After collection, the events are forwarded to the Wazuh manager, where the normalization engine decodes, normalizes, and enriches them into structured JSON documents for analysis and threat detection.
The process includes the following stages:
Raw log: The original log generated by the source.
Input event: The raw log after it is collected by the Wazuh agent and forwarded to the Wazuh manager, with Wazuh agent and cluster metadata added.
Normalized event: The final schema-conformant JSON document produced by the Wazuh normalization engine after decoding, normalization, and enrichment.
The following is a sample raw log:
{"version":"1.100000","account_id":"123456789023","region":"us-east-1","vpc_id":"vpc-0000000","query_timestamp":"2025-12-11T22:22:22Z","query_name":"amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com.","query_type":"AAAA","query_class":"IN","rcode":"NOERROR","answers":[{"Rdata":"s3-r-w.dualstack.us-east-1.amazonaws.com.","Type":"CNAME","Class":"IN"},{"Rdata":"2a02:cf40:add:4444:9191:a9a9:aaaa:cccc","Type":"AAAA","Class":"IN"}],"srcaddr":"8.8.8.8","srcport":"8010","transport":"UDP","srcids":{}}
Input event sample:
{
"wazuh": {
"protocol": {
"queue": 49,
"location": "/var/ossec/logs/active-responses.log"
},
"agent": {
"host": {
"os": {
"name": "Rocky Linux",
"version": "8.10",
"platform": "rocky",
"type": "linux"
},
"architecture": "x86_64",
"hostname": "wazuh-agent-50-rocky8"
},
"id": "002",
"name": "wazuh-agent-50-rocky8",
"version": "v5.0.0",
"groups": [
"default"
]
},
"cluster": {
"name": "wazuh",
"node": "node01"
}
},
"event": {
"original": "{\"version\":\"1.100000\",\"account_id\":\"123456789023\",\"region\":\"us-east-1\",\"vpc_id\":\"vpc-0000000\",\"query_timestamp\":\"2025-12-11T22:22:22Z\",\"query_name\":\"amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com.\",\"query_type\":\"AAAA\",\"query_class\":\"IN\",\"rcode\":\"NOERROR\",\"answers\":[{\"Rdata\":\"s3-r-w.dualstack.us-east-1.amazonaws.com.\",\"Type\":\"CNAME\",\"Class\":\"IN\"},{\"Rdata\":\"2a02:cf40:add:4444:9191:a9a9:aaaa:cccc\",\"Type\":\"AAAA\",\"Class\":\"IN\"}],\"srcaddr\":\"8.8.8.8\",\"srcport\":\"8010\",\"transport\":\"UDP\",\"srcids\":{}}"
}
}
Normalized event in the Wazuh manager:
{
"related": {
"hosts": [
"amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com."
],
"ip": [
"8.8.8.8"
]
},
"dns": {
"question": {
"class": "IN",
"type": "AAAA",
"name": "amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com."
},
"answers": [
{
"data": "s3-r-w.dualstack.us-east-1.amazonaws.com.",
"class": "IN",
"type": "CNAME"
},
{
"data": "2a02:cf40:add:4444:9191:a9a9:aaaa:cccc",
"type": "AAAA",
"class": "IN"
}
],
"response_code": "NOERROR"
},
"cloud": {
"region": "us-east-1",
"account": {
"id": "123456789023"
},
"provider": "aws"
},
"wazuh": {
"space": {
"name": "standard"
},
"event": {
"id": "71d29672-07b0-4078-af5b-ee3401770fb7"
},
"integration": {
"decoders": [
"decoder/core-wazuh-message/0",
"decoder/aws-route53-resolver-logs/0"
],
"name": "aws",
"category": "cloud-services"
},
"protocol": {
"location": "-",
"queue": 1
}
},
"network": {
"protocol": "dns",
"type": "IPv4",
"transport": "udp"
},
"source": {
"geo": {
"continent_name": "North America",
"timezone": "America/Chicago",
"location": {
"lon": -97.822,
"lat": 37.751
},
"country_iso_code": "US",
"continent_code": "NA",
"country_name": "United States"
},
"address": "8.8.8.8",
"ip": "8.8.8.8",
"port": 8010,
"as": {
"organization": {
"name": "Google LLC"
},
"number": 15169
}
},
"event": {
"original": "{\"version\":\"1.100000\",\"account_id\":\"123456789023\",\"region\":\"us-east-1\",\"vpc_id\":\"vpc-0000000\",\"query_timestamp\":\"2025-12-11T22:22:22Z\",\"query_name\":\"amazonlinux-2-repos-us-east-1.s3.dualstack.us-east-1.amazonaws.com.\",\"query_type\":\"AAAA\",\"query_class\":\"IN\",\"rcode\":\"NOERROR\",\"answers\":[{\"Rdata\":\"s3-r-w.dualstack.us-east-1.amazonaws.com.\",\"Type\":\"CNAME\",\"Class\":\"IN\"},{\"Rdata\":\"2a02:cf40:add:4444:9191:a9a9:aaaa:cccc\",\"Type\":\"AAAA\",\"Class\":\"IN\"}],\"srcaddr\":\"8.8.8.8\",\"srcport\":\"8010\",\"transport\":\"UDP\",\"srcids\":{}}",
"category": [
"network"
],
"action": "dns-query",
"kind": "event",
"type": [
"protocol"
],
"outcome": "success",
"start": "2025-12-11T22:22:22.000Z"
},
"@timestamp": "2026-06-17T12:38:54.937Z"
}
The above image shows the event flow through the Wazuh normalization engine.