soc/wazuh-docker/single-node/config/wazuh_cluster/local_rules....

<group name="soc_mvp_test,">
  <rule id="100200" level="10">
    <match>soc_mvp_test=true</match>
    <description>SOC MVP synthetic test event detected</description>
    <group>soc_mvp_test,syslog,</group>
  </rule>
</group>