active-response

Production-grade MCP server for Wazuh SIEM — 55 security tools for alert triage, threat hunting, vulnerability management, compliance (PCI DSS, GDPR, HIPAA, NIST CSF, ISO 27001) and active response. Connect Claude or any LLM to your SOC. OAuth 2.1, RBAC, multi-cluster, air-gap ready.

Lightweight Rust intrusion-signal monitor for Linux VPS hosts with alerts, active response, baselines, and a fleet panel.

Active Response plugin. Osquery to execute wazuh/ossec active response plugins. You can write your own plugins, easy to plug

Command-line interface for the Wazuh REST API - agents, alerts, vulnerabilities, active response and live TUI dashboard

Active Response for Cloudflare API

Enterprise-grade Wazuh SIEM/XDR + TheHive IRP deployment on WSL2 and Docker: detection engineering, MITRE ATT&CK mapping, automated active response, SOC dashboards & incident case management. Full SOC pipeline across 9 phases.

Enterprise Wazuh SIEM configuration with VirusTotal & MISP threat intelligence, OPNsense & MikroTik monitoring, automated active responses, Telegram SOC alerts, custom decoders/rules, and a Dockerized syslog collector. Includes MITRE ATT&CK mappings and ready-to-import dashboards.

A collection of Python utilities and build artifacts used to package and sign small Windows helper applications for interacting with Wazuh and endpoint workflows. This repository contains tools for isolation handling, application registration, threat removal helpers, and desktop notifications.

A documented SOC homelab: FortiGate-segmented network, Wazuh SIEM, Suricata NIDS, Sysmon, custom detections mapped to MITRE ATT&CK, and automated response with investigation reports.

An autonomous, lightweight Security Operations Center (SOC) designed for resource-constrained edge devices. Integrates a WAF, honeypots, and an LLM-powered AI analyst for automated threat detection and active response.

Wazuh EDR deployment guide - Docker single-node manager with Linux agents, active response automation and vulnerability management

SOC Zero Trust con deteccion y respuesta activa open source — TFG ASIR IES Valle Inclan 2025-2026

Complete Wazuh YARA configuration guide

This SOC semi-automation project integrates Wazuh, Shuffle, IRIS, MISP, Google Chat, and Grafana to handle and respond security incidents targeting DVWA on both Windows and Ubuntu. Goals: to execute automated security workflows for event collection, alert escalation, and incident response based on administrator decisions.

MODINE IDEAL: A High-Performance Cyber Defense & Intelligence Ecosystem. Engineered for proactive Threat Hunting, Zero-Day detection, and Automated Incident Response. Leveraging Wazuh and MITRE ATT&CK mapping to transform passive monitoring into an active security stronghold.

Wazuh SOC home lab showcasing SIEM deployment, Windows and Linux endpoint monitoring, Sysmon, File Integrity Monitoring, custom alert tuning, and automated Active Response. Includes attack simulations, detection analysis, and Python-based SOAR-style enrichment.

Wazuh Wanguard Andrisoft Integration active-response

SOC Automation Project (Wazuh, TheHive and Shuffle)

Complete Wazuh SOC Lab featuring custom DLP rules, Active Response, Telegram alerting, and advanced threat hunting dashboards.

Network Intrusion Detection with Suricata integrated into Wazuh SIEM