wazuh-indexer

Wazuh indexer, the Wazuh search engine

Security Analytics enables users for detecting security threats on their security event log data. It will also allow them to modify/tailor the pre-packaged solution.

In short, just give it access to your alerts.json, default rules, custom rules, archives.json, and magic happens.

This project simulates real-world PowerShell-based fileless attacks and Living-off-the-Land (LotL) techniques against a Windows 11 endpoint, then detects them using Agent forwarded to a Wazuh SIEM.

Notifications plugin for Wazuh Indexer enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-hook etc channels

Export and automate PNG, PDF, and CSV reports in Wazuh Dashboard

Offers a library of utilities for building Java-based Wazuh Indexer plugins

This project focuses on optimizing the Wazuh Indexer for a single-node setup by tuning shard counts, replica settings, index lifecycle policies (ISM), and increasing heap memory usage to avoid cluster overload and log ingestion issues.

Regras de correlação customizadas para Wazuh SIEM mapeadas ao MITRE ATT&CK

Home SOC Lab - WAZUH

Full-stack SOC lab using Wazuh, Sysmon, Atomic Red Team, FastAPI and React for attack simulation, detection validation and MITRE ATT&CK analysis.

MCP server for Wazuh 5.x. Query any events or findings datastream, discover which schema fields are actually populated, run logtest. Generic tools instead of fifty narrow ones. 5.x only — no 4.x compatibility layer.

Wazuh 4.9.1 modular deployment with Docker Compose and GitOps principles. Production-validated.

A self-hosted Security Operations Center lab for hands-on detection engineering