From Dev.to
Wazuh rule with <hostname> matches in wazuh-logtest but never fires for agent events
For an event that comes from an agent, analysisd sets the host name to the agent name before rules run, so in a rule is compared with that name. The alert still shows the syslog host under predecoder...