DEV Community

#wazuh

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides

Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides

Comments
3 min read
Wazuh ms-graph: why Entra ID sign-ins never reach the indexer, and a one-processor fix

Wazuh ms-graph: why Entra ID sign-ins never reach the indexer, and a one-processor fix

Comments
7 min read
One field path, two shapes: how Wazuh alerts get dropped with a 400 nobody sees

One field path, two shapes: how Wazuh alerts get dropped with a 400 nobody sees

Comments
2 min read
Two coverage zeros, two different causes

Two coverage zeros, two different causes

Comments
3 min read
From Setup to Signal: Building My First Wazuh SIEM with Sysmon and Atomic Red Team

From Setup to Signal: Building My First Wazuh SIEM with Sysmon and Atomic Red Team

Comments
9 min read
Your SIEM has never been asked a question it could fail

Your SIEM has never been asked a question it could fail

Comments
2 min read
A rule that is present, enabled, and silent: what Wazuh 92900 shows about coverage reports

A rule that is present, enabled, and silent: what Wazuh 92900 shows about coverage reports

Comments
2 min read
We replayed 24 ATT&CK techniques against a default Wazuh install. Three raised an alert.

We replayed 24 ATT&CK techniques against a default Wazuh install. Three raised an alert.

Comments
4 min read
Deploying and Validating a Wazuh SIEM with Atomic Red Team

Deploying and Validating a Wazuh SIEM with Atomic Red Team

Comments
8 min read
Building a Real SIEM Lab on a Mac Mini Fleet — What Actually Broke, and What I Learned Fixing It

Building a Real SIEM Lab on a Mac Mini Fleet — What Actually Broke, and What I Learned Fixing It

Comments
4 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.