[ossec-list] Notifications of the System audit events.

[orfan]

I have ossec-hids-server-2.6_2. 

 <rule id="509" level="0">
    <category>ossec</category>
    <decoded_as>rootcheck</decoded_as>
    <description>Rootcheck event.</description>
    <group>rootcheck,</group>
  </rule>

Decoded as "rootcheck", but i can't find rootcheck decoder in decoder.xml. 
Is it normal?