labels

The <labels> section adds custom metadata to events generated by the Wazuh agent. When an event triggers an alert, the configured labels are included in the alert data.

If email notifications are enabled on the Wazuh manager, the labels are also included in the corresponding email notifications.

Options

label

label

Defines a custom label and its value.

Use periods (.) in the label key to create nested fields in JSON-formatted alerts. For example, the key network.ip produces a nested network object containing the ip field.

Attributes:

key — The title that will describe the information of the label.

Allowed value

Any string that does not start with an underscore ( _ )

hidden — For labels that are hidden by default.

Default value	no
Allowed value	yes, no

Note

In internal_options.conf, hidden labels can be set to be displayed in alerts.

Note

Keys starting with an underscore character are reserved for the system labels. These labels are invisible and contain internal information of the agents.

Sample configuration

<labels>
  <label key="aws.instance-id">i-052a1838c</label>
  <label key="aws.sec-group">sg-1103</label>
  <label key="network.ip">172.17.0.0</label>
  <label key="network.mac">02:42:ac:11:00:02</label>
  <label key="installation" hidden="yes">January 1st, 2017</label>
</labels>