This project contains custom decoders and rules for Wazuh, created by me. Some rules are based on SOC Fortress rules, and some are my own decoders and rules.
- Put rules and decoder files under
/var/ossec/etc/rulesand/var/ossec/etc/decoders. - Put under
/var/ossec/integrationsfor integrations script - Put under
/var/ossec/active-response/bin/on agent side for active response script.
Feel free to use it, you can redistribute it and/or modify it under the terms of GPLv2. Cybersecurity is hard, so let's work together.
I will update rules and decoders if the projects I work on require them.
If you find my repository useful, I'm gladly accept a cup of coffee at ko-fi or trakteer