diff --git a/roles/debian/wazuh/files/custom_wazuh_rules.xml b/roles/debian/wazuh/files/custom_wazuh_rules.xml
new file mode 100644
index 000000000..8b9728ada
--- /dev/null
+++ b/roles/debian/wazuh/files/custom_wazuh_rules.xml
@@ -0,0 +1,26 @@
+<!-- Local rules -->
+<group name="local,">
+  <!-- Rule to detect a single 401 error -->
+  <rule id="100100" level="5">
+    <description>HTTP 401 response code</description>
+    <decoded_as>web-accesslog</decoded_as>
+    <match>" 401 </match>
+  </rule>
+
+  <!-- Frequency rule to detect multiple 401 errors -->
+  <rule id="100101" level="10" frequency="200" timeframe="3600">
+    <if_matched_sid>100100</if_matched_sid>
+    <same_source_ip />
+    <description>Multiple 401 errors from same source IP (possible brute force attempt)</description>
+    <options>no_full_log</options>
+  </rule>
+</group>
+
+<group name="whitelist,">
+  <rule id="100102" level="0">
+    <if_sid>521</if_sid>
+    <match>scantem</match>
+    <description>Whitelist alerts containing 'scantem' in the title.</description>
+    <options>no_full_log</options>
+  </rule>
+</group>
diff --git a/roles/debian/wazuh/tasks/main.yml b/roles/debian/wazuh/tasks/main.yml
index 7224c1c1e..6195e7a06 100644
--- a/roles/debian/wazuh/tasks/main.yml
+++ b/roles/debian/wazuh/tasks/main.yml
@@ -133,6 +133,24 @@
     state: restarted
   when: filebeat_exists
 
+- name: Check if wazuh-manager service exists
+  ansible.builtin.command: systemctl list-unit-files --type=service --no-pager
+  register: wazuh_service
+  ignore_errors: true
+  changed_when: false
+
+- name: Deploy custom Wazuh local rules
+  ansible.builtin.copy:
+    src: custom_wazuh_rules.xml
+    dest: "{{ wazuh_dir | default('/var/ossec') }}/etc/rules/custom_wazuh_rules.xml"
+    owner: wazuh
+    group: wazuh
+    mode: '0640'
+  notify: restart wazuh-manager
+  tags:
+    - rules
+  when: "'wazuh-manager.service' in wazuh_service.stdout"
+
 - name: Write the password to /var/ossec/etc/authd.pass
   ansible.builtin.copy:
     dest: /var/ossec/etc/authd.pass
@@ -146,4 +164,10 @@
   ansible.builtin.systemd:
     name: wazuh-manager
     state: restarted
-  when: "'wazuh-manager.service' in wazuh_service.stdout or 'wazuh-agent.service' in wazuh_service.stdout"
+  when: "'wazuh-manager.service' in wazuh_service.stdout"
+
+- name: Restart wazuh-agent to apply changes
+  ansible.builtin.systemd:
+    name: wazuh-agent
+    state: restarted
+  when: "'wazuh-agent.service' in wazuh_service.stdout"