Playbooks are correlation rules for any agent installed?

[xSunShine]

Hello,

Are Playbooks some kinda correlation rules for the logs that agents collect?Does PlayBook correlate all the logs,or wazuh has his own correlation rules(alerts)? Can someone clarify playbooks for me.
Thank you

[cm-ops]

A good place to start would be here - https://docs.securityonion.net/en/latest/playbook.html

[xSunShine]

thank you i have already read this, but as i have tested i didnt saw any playbook catch anything, i made all playbooks active, we do more testing and see

thank you

[xSunShine]

Wanted to ask, playbooks correleate and generate alerts based on HIDS? (agents) that collects logs? i just run meterpreter exe and only surricata dectected network trojan, and hids nothing(i installed wazuh) also i activated playbook about meteterpreter/cobaltatrike playbook, and nothing.Can someone explain.

Thabk you