Deploy free SOCFortress UBA with Wazuh and CoPilot to turn scattered events into one explainable, identity-based risk alert. Full video walkthrough and demo.

Protect your LLM applications from Denial-of-Wallet attacks, bot flooding, and runaway token costs. See how Wazuh SIEM turns token telemetry into actionable security alerts.

Running Microsoft Defender XDR alongside Wazuh? Learn how to unify incidents, alerts, and Defender for Cloud events in a single Wazuh dashboard using custom rules, with no more switching between consoles.

Build Wazuh decoders that actually work, from a handful of sample logs.

All Wazuh rules and decoders brought together in one place. Over 110 community sources plus the Wazuh blog: 16,500+ rules, 5,300+ decoders and 479 packs, each file unchanged and credited to its original author.

Wazuh meets NCA ECC: a community pack maps Saudi Essential Cybersecurity Controls (ECC-2:2024) to native Wazuh capabilities, with no extra agents and no built-in rules modified.

Detection has to be behavioral, at the syscall level. This repository provides auditd sensor rules and Wazuh detection rules built on four axes, plus an SCA policy that checks the sensor and the exploit prerequisites on each endpoint: