diff --git a/Auditd/decoders/README.md b/Auditd/decoders/README.md
deleted file mode 100644
index cfc96af..0000000
--- a/Auditd/decoders/README.md
+++ /dev/null
@@ -1,26 +0,0 @@
-Use custom decoders rather than the ones provided by Wazuh. I was seeing issues during testing with their provided decoders.
-
-Remember to exclude Wazuh's default auditd decoder and rules within the `ossec.conf` of the manager:
-
-```
-<ruleset>
-    <!-- Default ruleset -->
-    <decoder_dir>ruleset/decoders</decoder_dir>
-    <decoder_exclude>ruleset/decoders/0040-auditd_decoders.xml</decoder_exclude>
-    <rule_dir>ruleset/rules</rule_dir>
-    <rule_exclude>0215-policy_rules.xml</rule_exclude>
-    <rule_exclude>0365-auditd_rules.xml</rule_exclude>
-    <list>etc/lists/audit-keys</list>
-    <list>etc/lists/amazon/aws-eventnames</list>
-    <list>etc/lists/security-eventchannel</list>
-    <list>etc/lists/software-vendors</list>
-    <list>etc/lists/common-ports</list>
-    <list>etc/lists/rfc-1918</list>
-    <list>etc/lists/cve</list>
-    <list>etc/lists/malicious-powershell</list>
-    <list>etc/lists/bash_profile</list>
-    <!-- User-defined ruleset -->
-    <decoder_dir>etc/decoders</decoder_dir>
-    <rule_dir>etc/rules</rule_dir>
-  </ruleset>
-  ```
diff --git a/Auditd/decoders/auditd-config_change.xml b/Auditd/decoders/auditd-config_change.xml
deleted file mode 100644
index 3cf57dd..0000000
--- a/Auditd/decoders/auditd-config_change.xml
+++ /dev/null
@@ -1,38 +0,0 @@
-<decoder name="auditd-config_change">
-  <prematch>^type=CONFIG_CHANGE</prematch>
-</decoder>
-
-<!--
-type=CONFIG_CHANGE msg=audit(1672265894.539:138315): auid=4294967295 ses=4294967295 subj=unconfined op=add_rule key="T1497_Virtualization_Sandbox_Evasion_System_Checks" list=4 res=1AUID="unset"
--->
-
-<decoder name="auditd-config_change">
-  <parent>auditd-config_change</parent>
-  <!--<prematch offset="after_parent">^SYSCALL </prematch>-->
-  <regex offset="after_parent">msg=audit\(\d\d\d\d\d\d\d\d\d\d.\d\d\d:(\d+)\): </regex>
-  <order>audit.id</order>
-</decoder>
-
-<decoder name="auditd-config_change">
-  <parent>auditd-config_change</parent>
-  <regex>auid=(\S+) ses=(\S+) subj=(\S+) op=(\S+) </regex>
-  <order>audit.auid,audit.session,audit.subj,audit.op</order>
-</decoder>
-
-<decoder name="auditd-config_change">
-  <parent>auditd-config_change</parent>
-  <regex>key=\((\S+)\)|key="(\S+)"|key=(\S+) </regex>
-  <order>audit.key</order>
-</decoder>
-
-<decoder name="auditd-config_change">
-  <parent>auditd-config_change</parent>
-  <regex>list=(\S+)</regex>
-  <order>audit.list</order>
-</decoder>
-
-<decoder name="auditd-config_change">
-  <parent>auditd-config_change</parent>
-  <regex>res=(\S+)</regex>
-  <order>audit.res</order>
-</decoder>
diff --git a/Auditd/decoders/auditd-execve.xml b/Auditd/decoders/auditd-execve.xml
deleted file mode 100644
index 0862097..0000000
--- a/Auditd/decoders/auditd-execve.xml
+++ /dev/null
@@ -1,62 +0,0 @@
-<decoder name="auditd-execve">
-  <prematch>^type=EXECVE</prematch>
-</decoder>
-
-<!--
-type=EXECVE msg=audit(1672268062.108:138472): argc=2 a0="base64" a1="-d" a2="t" a3="chmod"
--->
-
-<decoder name="auditd-execve">
-  <parent>auditd-execve</parent>
-  <!--<prematch offset="after_parent">^SYSCALL </prematch>-->
-  <regex offset="after_parent">msg=audit\(\d\d\d\d\d\d\d\d\d\d.\d\d\d:(\d+)\): </regex>
-  <order>audit.id</order>
-</decoder>
-
-<decoder name="auditd-execve">
-  <parent>auditd-execve</parent>
-  <regex>argc=\d+ a0="(\.*)"</regex>
-  <order>audit.execve.a0</order>
-</decoder>
-
-<decoder name="auditd-execve">
-  <parent>auditd-execve</parent>
-  <regex>a1="(\.*)"</regex>
-  <order>audit.execve.a1</order>
-</decoder>
-
-<decoder name="auditd-execve">
-  <parent>auditd-execve</parent>
-  <regex>a2="(\.*)"</regex>
-  <order>audit.execve.a2</order>
-</decoder>
-
-<decoder name="auditd-execve">
-  <parent>auditd-execve</parent>
-  <regex>a3="(\.*)"</regex>
-  <order>audit.execve.a3</order>
-</decoder>
-
-<decoder name="auditd-execve">
-  <parent>auditd-execve</parent>
-  <regex>a4="(\.*)"</regex>
-  <order>audit.execve.a4</order>
-</decoder>
-
-<decoder name="auditd-execve">
-  <parent>auditd-execve</parent>
-  <regex>a5="(\.*)"</regex>
-  <order>audit.execve.a5</order>
-</decoder>
-
-<decoder name="auditd-execve">
-  <parent>auditd-execve</parent>
-  <regex>a6="(\.*)"</regex>
-  <order>audit.execve.a6</order>
-</decoder>
-
-<decoder name="auditd-execve">
-  <parent>auditd-execve</parent>
-  <regex>a7="(\.*)"</regex>
-  <order>audit.execve.a7</order>
-</decoder>
diff --git a/Auditd/decoders/auditd-path.xml b/Auditd/decoders/auditd-path.xml
deleted file mode 100644
index 21ad6ec..0000000
--- a/Auditd/decoders/auditd-path.xml
+++ /dev/null
@@ -1,20 +0,0 @@
-<decoder name="auditd-path">
-  <prematch>^type=PATH</prematch>
-</decoder>
-
-<!--
-type=PATH msg=audit(1672316980.514:138523): item=0 name="/usr/bin/grep" inode=2398 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
--->
-
-<decoder name="auditd-path">
-  <parent>auditd-path</parent>
-  <!--<prematch offset="after_parent">^SYSCALL </prematch>-->
-  <regex offset="after_parent">msg=audit\(\d\d\d\d\d\d\d\d\d\d.\d\d\d:(\d+)\): item=\S+ name="(\.*)" inode=(\S+) dev=\S+ mode=(\S+) ouid=\S+ ogid=\S+ rdev=\S+ nametype=(\S+) </regex>
-  <order>audit.id,audit.directory.name, audit.directory.inode, audit.directory.mode,audit.directory.nametype</order>
-</decoder>
-
-<decoder name="auditd-path">
-  <parent>auditd-path</parent>
-  <regex offset="after_regex">type=PATH msg=audit\(\S+\): item=\S+ name="(\.*)" inode=(\S+) dev=\S+ mode=(\S+) ouid=\S+ ogid=\S+ |type=PATH msg=audit\(\S+\): item=\S+ name=\((null)\) inode=(\S+) dev=\S+ mode=(\S+) ouid=\S+ ogid=\S+ </regex>
-  <order>audit.file.name, audit.file.inode, audit.file.mode</order>
-</decoder>
diff --git a/Auditd/decoders/auditd-syscall.xml b/Auditd/decoders/auditd-syscall.xml
deleted file mode 100644
index b865238..0000000
--- a/Auditd/decoders/auditd-syscall.xml
+++ /dev/null
@@ -1,43 +0,0 @@
-<decoder name="auditd-syscall">
-  <prematch>^type=SYSCALL</prematch>
-</decoder>
-
-<!--
-  type=SYSCALL msg=audit(1479982525.380:50): arch=c000003e syscall=2 success=yes exit=3 a0=7ffedc40d83b a1=941 a2=1b6 a3=7ffedc40cce0 items=2 ppid=432 pid=3333 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=2 comm="touch" exe="/bin/touch" key="audit-wazuh-w" type=CWD msg=audit(1479982525.380:50):  cwd="/var/log/audit" type=PATH msg=audit(1479982525.380:50): item=0 name="/var/log/audit/tmp_directory1/" inode=399849 dev=ca:02 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=PARENT type=PATH msg=audit(1479982525.380:50): item=1 name="/var/log/audit/tmp_directory1/malware.py" inode=399852 dev=ca:02 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=CREATE type=PROCTITLE msg=audit(1479982525.380:50): proctitle=746F756368002F7661722F6C6F672F61756469742F746D705F6469726563746F7279312F6D616C776172652E7079
--->
-<!-- ID -->
-
-<decoder name="auditd-syscall">
-  <parent>auditd-syscall</parent>
-  <!--<prematch offset="after_parent">^SYSCALL </prematch>-->
-  <regex offset="after_parent">msg=audit\(\d\d\d\d\d\d\d\d\d\d.\d\d\d:(\d+)\): </regex>
-  <order>audit.id</order>
-</decoder>
-
-<!-- SYSCALL -->
-<decoder name="auditd-syscall">
-  <parent>auditd-syscall</parent>
-  <regex offset="after_regex">^arch=(\S+) syscall=(\d+) success=(\S+) exit=(\S+) a0=\S+ a1=\S+ a2=\S+ a3=\S+ items=\S+ ppid=(\S+) pid=(\S+) auid=(\S+) uid=(\S+) gid=(\S+) euid=(\S+) suid=(\S+) fsuid=(\S+) egid=(\S+) sgid=(\S+) fsgid=(\S+) tty=(\S+) ses=(\S+) comm=\p(\S+)\p exe=\p(\S+)\p</regex>
-  <order>audit.arch,audit.syscall,audit.success,audit.exit,audit.ppid,audit.pid,audit.auid,audit.uid,audit.gid,audit.euid,audit.suid,audit.fsuid,audit.egid,audit.sgid,audit.fsgid,audit.tty,audit.session,audit.command,audit.exe</order>
-</decoder>
-
-<!-- SYSCALL - command -->
-<decoder name="auditd-syscall">
-  <parent>auditd-syscall</parent>
-  <regex offset="after_regex">comm=\p*(\w+)\p*</regex>
-  <order>audit.command</order>
-</decoder>
-
-<!-- SYSCALL - exe -->
-<decoder name="auditd-syscall">
-  <parent>auditd-syscall</parent>
-  <regex offset="after_regex">exe=\p(\S+)\p</regex>
-  <order>audit.exe</order>
-</decoder>
-
-<!-- SYSCALL - key -->
-<decoder name="auditd-syscall">
-  <parent>auditd-syscall</parent>
-  <regex offset="after_regex">key=\((\S+)\)|key="(\S+)"|key=(\S+)</regex>
-  <order>audit.key</order>
-</decoder>
diff --git a/Auditd/decoders/auditd-user_and_cred.xml b/Auditd/decoders/auditd-user_and_cred.xml
deleted file mode 100644
index 5587812..0000000
--- a/Auditd/decoders/auditd-user_and_cred.xml
+++ /dev/null
@@ -1,52 +0,0 @@
-<decoder name="auditd-user_and_cred">
-  <prematch>^type=</prematch>
-</decoder>
-
-<!--
-type=USER_ACCT msg=audit(1480087217.108:6042): pid=6013 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/sshd" hostname=10.10.10.100 addr=10.10.10.100 terminal=ssh res=success'
-
-type=CRED_ACQ msg=audit(1480087217.108:6043): pid=6013 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/sshd" hostname=10.10.10.100 addr=10.10.10.100 terminal=ssh res=success'
--->
-
-<decoder name="auditd-user_and_cred">
-  <parent>auditd-user_and_cred</parent>
-  <prematch offset="after_parent">^USER_ACCT |^CRED_ACQ |^USER_START |^CRED_REFR|^CRYPTO_KEY_USER|^CRYPTO_SESSION |^USER_AUTH |^USER_ROLE_CHANGE|^SERVICE_STOP </prematch>
-  <regex offset="after_parent">^(\S+) msg=audit\(\d\d\d\d\d\d\d\d\d\d.\d\d\d:(\d+)\): </regex>
-  <order>audit.type,audit.id</order>
-</decoder>
-
-<decoder name="auditd-user_and_cred">
-  <parent>auditd-user_and_cred</parent>
-  <regex offset="after_regex">^pid=(\S+) uid=(\S+) auid=(\S+) ses=(\S+)</regex>
-  <order>audit.pid,audit.uid,audit.auid,audit.session</order>
-</decoder>
-
-<decoder name="auditd-user_and_cred">
-  <parent>auditd-user_and_cred</parent>
-  <regex offset="after_regex">subj=(\S+)</regex>
-  <order>audit.subj</order>
-</decoder>
-
-<decoder name="auditd-user_and_cred">
-  <parent>auditd-user_and_cred</parent>
-  <regex offset="after_regex">acct="(\S+)"</regex>
-  <order>audit.acct</order>
-</decoder>
-
-<decoder name="auditd-user_and_cred">
-  <parent>auditd-user_and_cred</parent>
-  <regex offset="after_regex">unit=(\S+)</regex>
-  <order>audit.unit</order>
-</decoder>
-
-<decoder name="auditd-user_and_cred">
-  <parent>auditd-user_and_cred</parent>
-  <regex offset="after_regex">exe="(\S+)"</regex>
-  <order>audit.exe</order>
-</decoder>
-
-<decoder name="auditd-user_and_cred">
-  <parent>auditd-user_and_cred</parent>
-  <regex offset="after_regex">addr=(\S+)</regex>
-  <order>srcip</order>
-</decoder>