On Wazuh Rule Syntax documentation, the section does not mention which fields can be utilized or not.

We know that:

• agent.* properties are not usable for the <field> in rules.
• dstuser, srcip are not usable as they are static values.
• full_log is not usable, even though it is possible to write a rule without getting a syntax warning.

There are probably others too because they are generated on runtime as a part of enrichment and probably appears after rule check. Internals might change but this is important for users to write rules that work.