Blog / Engineering / Monitoring macOS resources with Wazuh
Monitoring macOS resources provides a comprehensive overview of the state of macOS resource usage. By doing this, organizations gain insights into the use of endpoint resources within their infrastructure. Monitoring macOS resources allows organizations to tackle potential performance issues and optimize resource utilization. Wazuh, an open source XDR, provides users with the ability to monitor and manage computer system security and performance effectively. […]
Blog / Engineering / Wazuh multi-site implementation
Wazuh multi-site implementation offers a solution that helps organizations unify their security monitoring capabilities across multiple geographically dispersed locations or sites. This implementation focuses on having Wazuh cluster components that collect, process, and store logs from the Wazuh agents within each site. A single Wazuh dashboard displays security alerts generated from events occurring in monitored […]
Blog / Engineering / Managing multiple Wazuh clusters with Cross-Cluster Search
Cross-Cluster Search (CCS) in Wazuh allows alerts from remote Wazuh clusters to be queried and viewed at a centralized location. The centralized location known as the Cross-Cluster Search (CCS) environment is trusted by the remote Wazuh clusters, enabling it to perform search operations. This lets security alerts be seen via a single Wazuh dashboard at […]
Blog / Engineering / Detecting DeerStealer malware with Wazuh
DeerStealer is a Windows-based stealer malware designed to steal sensitive user information, including login credentials, web browser data, and cryptocurrency wallet contents. It has similarities with other stealer malware like XFiles and Lummar. It is commonly spread through phishing emails and malvertising campaigns that appear trustworthy like the Google Authenticator incident. Upon infecting a system, […]
Blog / Engineering / Detecting Razr ransomware with Wazuh
Razr is a highly destructive ransomware that compromises systems by encrypting files, effectively rendering them inaccessible to users. This ransomware commonly propagates through phishing emails containing malicious attachments or by exploiting vulnerabilities in software and operating systems. Once infected, the Razr ransomware scans for valuable data, including documents, images, and databases. It activates its payload […]
