Wazuh 5.0 will not load custom XML rules

Wazuh 5.0 drops support for custom XML rules and decoders from 4.x: they must be manually rewritten as YAML and Sigma-style documents, with no automatic converter. An analysis of the public SOCFortress ruleset (2,211 rules) found 82% rely on rule chaining, which 5.0 no longer supports.

• Custom XML rules and decoders from 4.x are not loaded in 5.0, no converter exists
• 82% of 2,211 rules in the SOCFortress set use if_sid/if_group/if_level chaining
• In 5.0 rules live in the indexer as YAML, decoders are YAML assets
• Latest build is v5.0.0-beta5, no GA date announced