Sysmon and wazuh integration with Sigma sysmon rules [updated]

Command line tool to review, merge and modify OSSEC/Wazuh rules in bulk

Guide explaining how to deploy the entire Threat Intelligence pipeline inside Wazuh.

Making Wazuh Deployment Easy

Integration scripts for Wazuh

An alternative to "wazuh-docker" with CI/CD-built images for amd64 and arm64, published on Docker Hub.

In short, just give it access to your alerts.json, default rules, custom rules, archives.json, and magic happens.

☢️ Python script to send Wazuh alerts to Telegram by bot.

This script is for demo purposes only. It deploys a bare minimum, single-node Docker host and Wazuh stack running as a docker-compose stack.

Setting Up Wazuh SIEM/XDR Homelab and Integration of Microsoft Defender into it.

Akamai integration for Wazuh that fetches events using the SIEM API

Docker Container Setup with Wazuh for Vulnerability Scanning DVWA Container

Dieses Projekt zeigt Schritt für Schritt, wie man mit Wazuh, pfSense und Windows 11 ein komplettes SIEM-/XDR-HomeLab aufbaut, Windows-Endpoints per Agent einbindet und typische Monitoring-Szenarien wie File Integrity Monitoring (FIM) und Registry-Überwachung in einer virtuellen Testumgebung umsetzt.

Docker image and Helm chart for Wazuh Manager and Filebeat, configurable for sending alerts to a specific OpenSearch instance 🐺

AI-powered Wazuh alert triage and response platform — MITRE ATT&CK insights and automated GitLab incident creation over mTLS

Wazuh, Suricata, IDS, Threat Detection: Integrating Suricata with Wazuh to detect network reconnaissance activity and centralize security monitoring.

Implementing a comprehensive and scalable security monitoring solution for Windows endpoint.

Wazuh, Auditd, Threat Hunting | Detecting privileged command execution and endpoint activity through centralized log monitoring.

Install wazuh-manager and ELK cluster in Amazon Opsoworks

In Progress Project: A lab-based SOC simulation using Wazuh SIEM/XDR to detect real-world attack scenarios including database exfiltration, credential theft, and insider enumeration across a virtualized environment.