Wazuh active response: Cannot read 'srcip' from data

The rule fired, the alert is in alerts.json, and the block did not happen. This line is written by a Wazuh active response, not by the rule engine. There are two different cases. In the first, the alert had no usable source IP in the places the script reads. In the second, on Windows agents, measured on 4.14.7, netsh.exe and route-null.exe wrote... Weiterlesen: Wazuh active response: Cannot read 'srcip' from data