<group name="socfortress_healthcheck,">
 <rule id="200990" level="3">
    <field name="integration">^socfortress_healthcheck$</field>
    <description>SOCFortress Healthcheck</description>
    <options>no_full_log</options>
  </rule>
  <rule id="200991" level="3">
    <if_sid>200990</if_sid>
    <field name="current_status">^healthy$</field>
    <description>SOCFortress Healthcheck is Healthy</description>
    <options>no_full_log</options>
  </rule>
  <rule id="200992" level="12">
    <if_sid>200990</if_sid>
    <field name="current_status">^unhealthy$</field>
    <description>SOCFortress Healthcheck Unhealthy state - $(message).</description>
    <options>no_full_log</options>
  </rule>
  <rule id="200993" level="12">
    <if_sid>200990</if_sid>
    <field name="current_status">^failure$</field>
    <description>SOCFortress Healthcheck Failed</description>
    <options>no_full_log</options>
  </rule>
 <rule id="200994" level="3">
    <decoded_as>json</decoded_as>
    <field name="cluster.name">\.+</field>
    <field name="level">^INFO$</field>
    <description>Wazuh-Indexer Cluster Logs - Level: INFO</description>
    <options>no_full_log</options>
  </rule>
  <rule id="200995" level="11">
    <decoded_as>json</decoded_as>
    <field name="cluster.name">\.+</field>
    <field name="level">^WARN$</field>
    <description>Wazuh-Indexer Cluster Logs - Level: WARN</description>
    <options>no_full_log</options>
  </rule>
  <rule id="200996" level="12">
    <decoded_as>json</decoded_as>
    <field name="cluster.name">\.+</field>
    <field name="level">^ERROR$</field>
    <description>Wazuh-Indexer Cluster Logs - Level: ERROR</description>
    <options>no_full_log</options>
  </rule>
</group>
