Six Wazuh rules, one safe test script, and a clear case for behavioral detection. Learn how to spot SharePoint ToolShell exploitation with Wazuh and Sysmon.
An alert can be technically complete and still impossible to triage. In part 4 of the AI-Augmented Wazuh Operations series, an enrichment pipeline was built. An orchestrator pulls context from threat intel, the CMDB, the directory and the Wazuh indexer. A model correlates it into a brief. The analyst still makes the final call.
Zero undocumented deviations beats a higher compliance score. Learn how wazuhscatune turns Wazuh SCA tailoring into a loosening guide that others can review.
One custom SSH rule, nine tools, and evidence for every part of it. Zafer Balkan walks through his Wazuh 4.x toolkit for testing and validating rules.
Migrating custom rules and decoders from Wazuh 4.14.8 to 5.0? Learn how to rewrite your 4.x XML detection content, a step the official docs leave out.
Deploy free SOCFortress UBA with Wazuh and CoPilot to turn scattered events into one explainable, identity-based risk alert. Full video walkthrough and demo.
Protect your LLM applications from Denial-of-Wallet attacks, bot flooding, and runaway token costs. See how Wazuh SIEM turns token telemetry into actionable security alerts.
Running Microsoft Defender XDR alongside Wazuh? Learn how to unify incidents, alerts, and Defender for Cloud events in a single Wazuh dashboard using custom rules, with no more switching between consoles.