From Dev.to
Wazuh active response: Cannot read 'srcip' from data
The rule fired, the alert is in alerts.json, and the block did not happen. This line is written by a Wazuh active response, not by the rule engine. There are two different cases. In the first, the ale...