Wazuh and Windows Sysinternals - Integrations

Wazuh and Windows Sysinternals.

Open-Source based end-point detection using WAZUH HIDS.

Sysmon events enriched with Mitre TTPs

WAZUH AND DOMAIN STATS + ALIENVAULT OTX

Wazuh and Domain Stats Integration.

New, first seen or suspicious domains checked against AlienVault OTX IoCs via Wazuh’s Active Response.

WINDOWS SOFTWARE POLICY USING WAZUH AND SYSINTERNALS

Applying a software/application policy using Wazuh and Sysinternals.

Detection mode: events where a process is started but is not part of the software policy will generate an alert.

Prevention mode: events where a process is started but is not part of the software policy will be suspended.

USING WAZUH AND CHAINSAW FOR WINDOWS EVT LOGS FORENSIC ANALYSIS

Wazuh and Chainsaw integration to run forensic analysis.

Use Chainsaw to collect past artifacts still present in the WinEvtLogs and take Chainsaw’s output to the Wazuh manager.

Apply DFIR at any given time.

Wazuh and Snyk (snyk.io) integration to scan Docker image vulnerabilities.

In this integration we'll use Snyk’s CLI to scan for vulnerabilities in the Docker images and all their dependencies.

Wodle Command configured to run periodic security scans in all Docker images used in the host.

Apply DFIR at any given time.