diff --git a/source/user-manual/manager/wazuh-archives.rst b/source/user-manual/manager/wazuh-archives.rst index 96402e9f88..1e58127c64 100644 --- a/source/user-manual/manager/wazuh-archives.rst +++ b/source/user-manual/manager/wazuh-archives.rst @@ -92,6 +92,13 @@ Wazuh dashboard :align: center :width: 80% +#. Alternatively, the ``wazuh-archives-*`` index can be created via the command line using curl with the admin password: + + .. code-block:: bash + + $ curl -k -u admin:"$ADMIN_PASS" -X PUT "https://127.0.0.1:9200/_index_pattern/wazuh-archives-" -H 'Content-Type: application/json' -d '{"index_pattern":"wazuh-archives-*","priority":100,"time_field":"timestamp","fields":[{"name":"@timestamp","type":"date","format":"date_time"}]}' + + Use case: Detecting signed binary proxy execution ------------------------------------------------- @@ -406,4 +413,4 @@ Use the Wazuh archives to query and display events related to the technique bein } }, -You can use events from the Wazuh archives to develop detection logic and write custom decoders and rules. You can use the out-of-the-box ``wazuh-logtest`` tool to test and verify rules against provided logs. For more information, see the :doc:`Custom rules and decoders ` and the :doc:`wazuh-logtest ` documentation. \ No newline at end of file +You can use events from the Wazuh archives to develop detection logic and write custom decoders and rules. You can use the out-of-the-box ``wazuh-logtest`` tool to test and verify rules against provided logs. For more information, see the :doc:`Custom rules and decoders ` and the :doc:`wazuh-logtest ` documentation.