Wazuh MCP Server: AI-Driven SOC Automation
RuleVis is a powerful analysis tool that transforms your Wazuh ruleset into a dynamic, interactive force-directed graph. It helps you visualize the complex relationships between rules, identify critical dependencies, discover structural issues, and analyze the distribution of your rule IDs.
A Python tool that parses EVTX files and converts them into JSON formatted logs mimicking Wazuh agent behavior in version 4.x. wazuhevtx is designed as a helper for wazuh-logtest tool.
The project utilizes of a wazuh-manager installed on WSL or a Linux machine, allowing testing custom rules locally before moving to production.
A helper for Wazuh Security Configuration Assessment (SCA) to create a custom SCA based on loosening.
This project simulates real-world PowerShell-based fileless attacks and Living-off-the-Land (LotL) techniques against a Windows 11 endpoint, then detects them using Agent forwarded to a Wazuh SIEM.
In short, just give it access to your alerts.json, default rules, custom rules, archives.json, and magic happens.
Cloud Security & SOC portfolio with AWS labs, SIEM monitoring, and threat analysis. AWS | Wazuh | Splunk | Python
Production-grade, multi-container SOC Automation & ITSM Platform. Integrates Wazuh SIEM alert ingestion, SafeLine WAF defense, n8n SOAR workflows, multi-channel Slack notifications, Active Directory LDAPS authentication, and an RBAC incident ticketing dashboard (FastAPI + React).
AI-powered SOC triage assistant for Wazuh with MITRE ATT&CK mapping, incident reporting, notifications and a Streamlit dashboard.
A tool to help detection engineers generate Wazuh rule tests either derived from INI test files from Wazuh repository, Windows Event Log (EVTX) files, or Wazuh rule files. The test format uses Python's unittest. It is designed to accompany wazuh-devenv project.
He configurado y documentado este proyecto de endurecimiento (hardening) en Bash para aplicar las políticas de seguridad del CIS Benchmark en Ubuntu y verificar su cumplimiento desde Wazuh SIEM.
SOC Home Lab using Wazuh SIEM for detection and incident response
Scripts are accompanying the blog post
Community-built Wazuh knowledge base — custom detection rules, SOC simulations, integrations, compliance labs, and Wazuh 5.0 migration guides. Open to all levels.
Moringa-CyberDrill: Interactive Zero-VM Lab Simulator & Exam Mastery Engine for Moringa Cyber Security Students
Home lab documenting hands-on detection and response work using Wazuh SIEM. Covers both manual investigation workflows and automated response pipelines.
Wazuh is a free, open-source security platform that unifies SIEM and XDR. It is designed to protect endpoints, such as servers, virtual machines, and cloud workloads, by monitoring them for threats.
Regras de correlação customizadas para Wazuh SIEM mapeadas ao MITRE ATT&CK
SOC analyst write-ups: malware analysis, YARA testing, threat detection
To associate your repository with the wazuh-siem topic, visit your repo's landing page and select "manage topics."