Adding new decoders and rule
1. Add the following rule to /var/ossec/etc/rules/local_rules.xml

{
  // Rule definition
  "rule": {
    // Unique identifier for the rule
    "id": "199926",

    // Severity or priority level of the rule
    "level": 12,

    // Protocol or format the rule is designed to interpret
    "decoded_as": "syslog",

    // Human-readable description of the rule's purpose
    "description": "Detect unknown local users in system logs",

    // User level or permissions required to view or modify this rule
    "user_level": 0,

    // Specifies whether the rule is ignorable
    "ignorable": "no",

    // Assigns the rule to a specific group
    "group": "syslog",

    // Conditions or criteria for the rule
    "options": {
      // Attribute being checked (in this case, the log message)
      "message": ".User.*cisco_tac_admin.*logged in.|.User.*cisco_support.*logged in.|.User.*unknown_user.*logged in."
    }
  }
}

2. Run /var/ossec/bin/wazuh-logtest

3. Restart the Wazuh manager to load the updated rules and decoders