This hands-on document walks through building a ransomware detection lab using Wazuh, covering File Integrity Monitoring (FIM), Auditd integration, custom detection rules, Active Response, and safe ransomware simulation for testing and learning.
Diagnosis, solution and definitive prevention
Database Activity Monitoring, compliance auditing and validated evidence for MariaDB/MySQL, PostgreSQL and SQL Server
Adding Caddy detection rulesets and expanding Wazuh’s coverage.
This article is a practical look at how Wazuh can support audit-ready evidence: what to configure, what to review, what to document, what to retain, and what to be ready to explain during an audit.
In this article, you’ll learn how to integrate a powerful next-generation firewall (NGFW) with the Wazuh system using a FortiGate device as an example. Without installing any agents, using the reliable Syslog protocol.
In this article, we’ll follow the journey of a security event from the moment it is generated on an endpoint until it appears as an actionable alert.
How to wire up Wazuh active response with CDB threat intelligence lists and AWS SES suppression to auto-block malicious senders — no tickets, no humans in the loop