Active Response not triggering

[Cmbrlnd]

Wazuh version	Component	Install type	Install method	Platform
V4.5.2	Manager	All-in-one	Packages	Ubuntu 22.04.3 LTS

Hi all,
A few days ago I installed Wazuh on a server and setup a few agents. One a Windows PC (Win10) and another agent running Linux (Debian). I was interested in the Blocking of SSH bruteforce using Active Response, I followed this documentation to set it up:
https://documentation.wazuh.com/current/user-manual/capabilities/active-response/ar-use-cases/blocking-ssh-brute-force.html

I have already tried some basic troubleshooting and have restarted all the wazuh services and even uninstalled and re-installed using all-in-one method but it does not appear to have helped.

My logs and conf:
Active Response Troubleshooting.zip
ossec.conf
wazuhapp.log
wazuh-cluster.log
filebeat
active-responses.log - empty

---

1. Open the Wazuh server /var/ossec/etc/ossec.conf file and verify that a block called firewall-drop with the following configuration is present within the <ossec_config> block:

  <command>
    <name>firewall-drop</name>
    <executable>firewall-drop</executable>
    <timeout_allowed>yes</timeout_allowed>
  </command>

I have checked the ossec.conf file and on line 257 the above is correct.

---

2. Add the block below to the Wazuh server /var/ossec/etc/ossec.conf configuration file:

<ossec_config>
  <active-response>
    <command>firewall-drop</command>
    <location>local</location>
    <rules_id>5763</rules_id>
    <timeout>180</timeout>
  </active-response>
</ossec_config>

I have put my block just below the example active response block in ossec.conf line 293:
I have tried a few different values in <rules_id> because when I attempt an SSH bruteforce on my Win10 agent it actually shows 60122
I have tried this using both hydra and manual password guessing with ssh, both throw 60122 in my instance.

How my <active-response> block looks in ossec.conf:

  <!--
  <active-response>
    active-response options here
  </active-response>
  -->
  
  <active-response>
    <command>firewall-drop</command>
    <location>local</location>
    <rules_id>5710,60122</rules_id>
    <timeout>180</timeout>
  </active-response>

---

3. Restart the Wazuh manager service to apply the changes:

I have done this, several times and for the other Wazuh services too.

---

4. Testing

I have tried both manually password guessing and also using hydra when I use hydra I have used the example command in the documentation:

sudo hydra -t 4 -l <RHEL_USERNAME> -P <PASSWD_LIST.txt> <RHEL_IP> ssh

I can ping the target machine successfully before-hand.
I can initate the attack and see the following events in Wazuh for every password attempt:
Logon failure - Unknown user or bad password. - 60122

However, the Active Response rule never appears to trigger, I can continue the attack indefinitely.
When ceasing the attack I can instantly ping machine again.

Any help would be greatly appreciated, if there are more useful logs that I can supply please let me know.

Thank you!