Fix Synology NAS ruleset field names and dead storage-fault rule

[leonfullxr]

Summary

Fixes three defects in the Synology NAS ruleset that made its alerts incomplete or unreachable.

The integration files themselves already landed on main, so this branch was rebuilt on top of main and now carries only the fixes. The diff is rules/nas_synology_rules.xml plus one README line.

Fixes

Empty usernames in every authentication alert. Rules 100401 to 100404 interpolated $(synology_user), but the decoders write the username to the standard user field:

<regex>^User [(\S+)] from [(\d+.\d+.\d+.\d+)] failed to log in via [(\S+)]</regex>
<order>user, srcip, synology_app</order>

synology_user is never populated, so login failure, 2FA, sign-in and logout alerts all rendered user ''. Now $(user).

Storage-fault rule could never fire. Rule 100409 used <match>was removed|was degraded</match>. <match> is a literal substring test, so the | was compared literally and no Synology log line contains was removed|was degraded. Drive removal and volume degradation, the two highest-severity events in the ruleset at level 10, produced no alert.

Split into two rules rather than switching to <regex>, because one rule cannot describe both events correctly: a drive event populates synology_drive and a volume event populates synology_volume, so the old combined description always left one field empty.

Rule	Match	Description
100409	was removed	Drive $(synology_drive) was removed
100410	was degraded	Volume $(synology_volume) is degraded ($(synology_status))

README overstated coverage. It advertised alerting on "2FA failures" while the ruleset matches only the 2FA success message (successfully passed the first authentication of 2FA). Reworded to what the rules actually cover. No 2FA failure rule was added, since neither the decoders nor sample_logs.txt contain that log format and inventing one unverified would be worse than documenting the real coverage.

Verification

No Wazuh manager was available, so verification was static, checking the two properties that failed here against sample_logs.txt:

1. Every rule's literal <match> string occurs in at least one sample log line, treating <match> as a substring test with no alternation.
2. Every $(field) interpolated in a description appears in some decoder's <order>.

Before the fix this reported the five real defects and nothing else:

100409: <match> contains '|', which is a literal pipe, not alternation
100409: <match> 'was removed|was degraded' matches no sample log line (dead rule)
100401: description references undecoded field(s) ['synology_user']
100402: description references undecoded field(s) ['synology_user']
100403: description references undecoded field(s) ['synology_user']
100404: description references undecoded field(s) ['synology_user']

After the fix all 11 rules resolve, covering all 14 sample log lines, with every interpolated field decoded. Both XML files parse cleanly.

Not exercised against a live manager: confirming with wazuh-logtest on a real Synology feed is still worth doing before this leaves draft.

Notes on the decoders

The decoders are unchanged and were reviewed as correct. The regexes may read as unescaped, but they follow OS_Regex rather than PCRE, where \. is the any-character class and [ is a literal, so \d+.\d+.\d+.\d+ correctly matches a dotted IP. Other decoders in this repository use the same convention.

[MiguelCasaresRobles]

Hi @leonfullxr — I know this is still a draft, so this is early feedback to help it along:

1. Field-name mismatch (blocking). In rules/nas_synology_rules.xml, rules 100401-100404 reference $(synology_user) in their descriptions, but no decoder ever sets a field by that name — nas_synology_decoders.xml uses <order>user, srcip, synology_app</order> (i.e. user). As-is, every one of those alerts renders with an empty username. Reference $(user) (or rename the decoder field).

2. README validation steps are wrong (high). The testing instructions tell readers to look for decoder name synology-nas (hyphen), but the decoder is declared as synology_nas (underscore). Anyone following the README verbatim will think the integration is broken.

3. Since there's no CI here, please run the bundled sample logs through wazuh-logtest and paste the output (at least one sample per decoder) so we can confirm the rendered alerts before this leaves draft.

Nits: base rule 100400 (level 3) fires on the benign "Test message from Synology Syslog Client" heartbeat — consider a dedicated low-noise/ignore rule; and 100409 combines drive-removed and volume-degraded into one rule, so its description always mentions both with one left empty.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.