Thanks u too

Same to you!

Have a great day too

Same 2 u bro

It was a bad day mate

From a blue team's perspective, disabling of UF/EDR would trigger a detection right away. Or, if logging stops coming in.

@@killacups there hasn't been a single case in the last 10 years when detection triggered upon killing the UF/Beat process.

Sorry, my answer was a bit more generalized. This completely depends on the environment.

Once elastic drops their update with their own native agents, wazuh will be useless. I’ve only ever used endgame for host agent (enterprise deployment) and if you’re somehow able to kill the endgame agent, it absolutely triggers an alert. Still can’t believe wazuh or beats doesn’t trigger on disable. That’s a huge open source gap if true

That's what we all say

No but Filebeat does

Yes it support integration of app log.

They are different products for logging. If you look into the Pricelists, you will see the difference 😂

By using wazuh you will reduce logs size which you sending to splunk.you can use wazuh as filter for spending important logs to splunk.

It’s EDR/XDR yes. But in combination with ELK it could be used as a SIEM. But I think there are still a lot of missing functionalities

There is video on youtube for s3 bucket integration with wazuh

Hi. Wazuh provides threat prevention, detection, and response capabilities and helps with regulatory compliance. It collects logs from disparate sources and analyzes near real time the security events. It also considers historical and contextual data allowing incident management. It has useful dashboards and reporting capabilities. Wazuh is indeed a complete SIEM + XDR platform. Perhaps you would like to discuss particular features you don't find in the product? What are the missing correlation capabilities? Thank you.