FREE Advanced Wazuh Detection Rules
Intro
Have Wazuh deployed and ingesting your logs but looking for some better detection rules? Look no further. The SOCFortress team has put together a repo to provide the Wazuh community with rulesets that are more accurate, descriptive, and enriched from various sources and integrations.
Access Repo — Don’t forget to give the project a star 😄
Our Goal
The Open Source community is a strong one, however, we believe that the Wazuh community is in need of “advanced” detection rules. Our hope is that this repo continues to grow with contributions not only from ourselves, but from the community.
- Detection rules can be a tricky business and we believe everyone should have access to a strong and growing ruleset.
- Wazuh serves as a great EDR agent, however the default rulesets are rather laxed (in our opinion). We wanted to start building a strong repo of Wazuh rules for the community to implement themselves and expand upon as new threats arise.
- Cybersecurity is hard enough, let’s work together 😄
Contributing
Contributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.
If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag “enhancement”.
- Fork the Project
- Create your Feature Branch (
git checkout -b ruleCategory/DetectionRule) - Commit your Changes (
git commit -m 'Add some DetectionRules') - Push to the Branch (
git push origin ruleCategory/DetectionRule) - Open a Pull Request
Need Help?
The functionality discussed in this post, and so much more, are available via the SOCFortress platform. Let SOCFortress help you and your team keep your infrastructure secure.
Website: https://www.socfortress.co/
Platform Demo: https://www.socfortress.co/demo_access.html
