Releases · H2FSpawn/wazuh-mikrotik-decoder

What's new

Firewall decoder now extracts dstip and dstport in addition to srcip and srcport. The -> separator was previously unescapable in Wazuh's regex engine — resolved by switching to pcre2 with \p\p.
DHCP decoder: client hostname now stored in extra_data2 (was being overwritten by Wazuh's pre-decoding phase)
Interface-down rule (110007) now fires reliably via if_sid chaining
Added test-logs/test-logs.txt with anonymized sample logs for all event types — paste directly into wazuh-logtest

See CHANGELOG.md for full details.