Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion source/getting-started/components/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
Components
==========

The Wazuh platform provides XDR and SIEM features to protect your cloud, container, and server workloads. These include log data analysis, intrusion and malware detection, file integrity monitoring, configuration assessment, vulnerability detection, and support for regulatory compliance.
The Wazuh platform provides Extended Detection and Response (XDR) and Security Information and Event Management (SIEM) features to protect your cloud, container, and server workloads. These include log data analysis, intrusion and malware detection, file integrity monitoring, configuration assessment, vulnerability detection, and support for regulatory compliance.

The Wazuh solution is based on the Wazuh agent, which is deployed on the monitored endpoints, and on three central components: the Wazuh server, the Wazuh indexer, and the Wazuh dashboard.

Expand Down
2 changes: 1 addition & 1 deletion source/getting-started/components/wazuh-agent.rst
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Agent modules

All agent modules are configurable and perform different security tasks. This modular architecture allows you to enable or disable each component according to your security needs. Below you can learn about the different purposes of all the agent modules.

- **Log collector:** This agent component can read flat log files and Windows events, collecting operating system and application log messages. It supports XPath filters for Windows events and recognizes multi-line formats like Linux Audit logs. It can also enrich JSON events with additional metadata.
- **Log collector:** This agent component can read flat log files and Windows events, collecting operating system and application log messages. It supports XPath (XML Path Language) filters for Windows events and recognizes multi-line formats like Linux Audit logs. It can also enrich JSON events with additional metadata.

- **Command execution:** Agents run authorized commands periodically, collecting their output and reporting it back to the Wazuh server for further analysis. You can use this module for different purposes, such as monitoring hard disk space left or getting a list of the last logged-in users.

Expand Down
2 changes: 1 addition & 1 deletion source/getting-started/index.rst
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
Getting started with Wazuh
==========================

Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments.
Wazuh is a free and open source security platform that unifies Extended Detection and Response (XDR) and Security Information and Event Management (SIEM) capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments.

Wazuh helps organizations and individuals to protect their data assets against security threats. It is widely used by thousands of organizations worldwide, from small businesses to large enterprises.

Expand Down
2 changes: 1 addition & 1 deletion source/getting-started/use-cases/incident-response.rst
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ The image below shows the following activities:

In this scenario, the Wazuh Active Response module automatically removes the malicious file, reducing the time between threat detection and mitigation.

Responding to DoS attacks
Responding to Denial of Serice (DoS) attacks
^^^^^^^^^^^^^^^^^^^^^^^^^

The primary goal of a DoS attack is to render the target inaccessible to legitimate users, causing a denial of service. In the image below, we show how the Wazuh Active Response module blocks malicious IP addresses performing a DoS against a web server on an Ubuntu endpoint.
Expand Down
2 changes: 1 addition & 1 deletion source/getting-started/use-cases/threat-hunting.rst
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,7 @@ Some third-party solutions that Wazuh integrates with to aid threat hunting are:

- **URLHaus**: `Integrating URLHaus by abuse.ch <https://wazuh.com/blog/detecting-malicious-urls-using-wazuh-and-urlhaus/>`__ with Wazuh amplifies threat intelligence capabilities, empowering users to proactively detect and block malicious URLs in real-time.

- **osquery**: Wazuh provides a module for managing the osquery tool from the Wazuh agents. The osquery module allows security analysts to configure and collect information generated by the osquery. It provides an extra layer for threat hunting capabilities such as configuration management, data collection, custom alerts based on osquery query results, and SQL-like syntax queries.
- **osquery**: Wazuh provides a module for managing the osquery tool from the Wazuh agents. The osquery module allows security analysts to configure and collect information generated by the osquery (tool for low-level operating system analytics and monitoring). It provides an extra layer for threat hunting capabilities such as configuration management, data collection, custom alerts based on osquery query results, and SQL-like syntax queries.

- **MISP**: We can enrich Wazuh alerts by automating identifications of IOCs and integrating MISP with Wazuh.

Expand Down