Wazuh 5.0 Migration

Your 4.x custom rules, running on Wazuh 5.0.

Send us your custom rules and decoders. We load them on 5.0 and tell you, rule by rule, which run, which go silent and which are rejected. Then we rewrite them the 5.0 way, fire each one with your own sample logs, and invoice after they run on your 5.0.

Start a migration — USD 490 per cluster →

Paid after it works: PayPal invoice or bank transfer once the rules run correctly on your 5.0. Wazuh 5.0 GA is not released yet; we re-test on the release you run. The measurements on this page are from 5.0.0-rc1.

Why this is not a version bump

What we measured on 5.0.0-rc1

Our own test containers, Wazuh 5.0.0-rc1, compared with 4.14.7 on the same log lines. Each line below is a measurement, not a reading of the release notes.

  • 4.x rule files go quiet, not loud. Our 4.x local_rules.xml and local_decoder.xml, dropped into etc/rules and etc/decoders: of 124 new log lines after restart, not one mentioned them, and the config check still returned success.
  • The 4.x rule keywords are gone. The 5.0.0-rc1 analysis engine binary contains zero occurrences of if_sid, if_matched_sid, same_srcip or frequency; the 4.14.7 binary contains all of them.
  • 4.x field names are rejected. Content using srcip was refused: “The following fields are not part of the Wazuh Common Schema (WCS): [srcip]”.
  • Frequency rules have no tested replacement yet. Nine pre-auth SSH disconnects from one IP produced zero findings with the stock ruleset; our 4.x frequency rule raised level 10 on the eighth. Rewritten as Sigma aggregation, the rule saved, but creating its detector failed with a NullPointerException, so it never ran; correlation rules produced zero correlations.
  • Unparsed logs disappear. A custom app log whose 4.x decoder was not rewritten is not indexed at all: index_unclassified_events defaults to false; all 4 custom-app lines among our 16 test lines were not indexed.
  • Parent and child both fire. A 4.x child rule rewritten in Sigma fires alongside its parent: the same SSH line produced both findings, where 4.x raised only the child.
  • Findings arrive up to about 20 seconds late by default. The default analysisd.indexer_flush_interval is 20 s; set to 5 s, the longest delay we saw was 7.1 s, through a 4.14.7 agent.
  • Active response does not reach 4.x agents. A 4.14.7 agent enrols with a 5.0.0-rc1 manager and its events are indexed, but the manager logs that the active response task is “not supported for legacy agents, not delivered”.

Not sure how much of your ruleset this touches? The self-serve Wazuh 5.0 Readiness Check (USD 49) reads your rules and sorts them before you commit to anything.

Scope

What you send, what you get.

You send

All your custom rules and decoders (etc/rules, etc/decoders, the XML files), your current Wazuh version, and 5–10 sample log lines per log source, with hostnames, IPs and usernames removed.

1

We load them on 5.0 (the newest RC or GA at the time, named in the report) and give you a table: every rule marked runs, silent or rejected, with the reason.

2

Each rule that needs it rewritten the 5.0 way (rule, Sigma or detector) and fired with your sample logs, so you see it work before it reaches your cluster.

3

Notes on the settings that change behaviour around your rules: indexer flush interval, and active response for agents still on 4.x.

When

Within 5 working days of receiving complete files. You pay after the rules run correctly on your own 5.0.

Not included

Upgrading your infrastructure or cluster, access to your machines, dashboards and visualisations, third-party integrations beyond rules and decoders, and performance guarantees. More than 150 custom rules: we quote separately.

Price

USD 490 per cluster

Invoiced after the rules run correctly on your 5.0, by PayPal invoice or bank transfer. Nothing is charged up front.

MSSPs and Wazuh partners: USD 343 per end-customer cluster (30% off). You resell at your own price under your name; we work from the files you send.

Start

Tell us about your cluster.

No files yet. We reply with where to send them and a confirmation of scope, usually within a working day.

support@atkvn.com
Limits of what we measured

All numbers above come from 5.0.0-rc1 in our own containers: one manager, one indexer node with the security plugin disabled, our own test rules and log lines. 5.0.0-rc2 was published on 30 October 2026 and we have not re-measured on it yet; 5.0 GA is not released. Not yet measured: CDB lists moved to the new key-value store, whether Sigma timeframe is honoured, and clusters with TLS and several nodes. Wazuh may add or change content before GA, which is why the work is re-tested on the release you actually run.