April 20, 2022

Wazue server manager and worker step by step

Wazuh EDR (Endpoint detection and response)

Wazuh EDR (Endpoint Detection and Response) is a security feature of the Wazuh platform that provides real-time detection and response capabilities for endpoint devices.

It uses a combination of signature-based and behavioral-based detection techniques to identify and alert on potential security threats or anomalies on endpoint devices. Wazuh EDR can be configured to monitor a variety of endpoint activity, such as file and network activity, system logs, and system configurations.

It can also be configured to perform specific actions in response to detected threats, such as quarantining a file or blocking network access.

Wazuh EDR is designed to provide a comprehensive view of endpoint security and to help organizations respond quickly to security incidents.

Wazuh EDR (Endpoint detection and response) Read More »

Elasticsearch Machine Learning with Zeek IDS to Detecting Malware Behavior2

What is a network anomaly? Detecting network malware behavior requires more than just the detection of IOCs, such as files and network signatures. Why? Let’s think about it for a moment: when an antivirus detects malware using signatures, the detection is limited only to what that antivirus has in its database. The behavior of the malware is the anomaly we are looking for. We will identify the anomaly in network traffic using Elasticsearch Machine Learning and IDS-based Zeek

Elasticsearch Machine Learning with Zeek IDS to Detecting Malware Behavior2 Read More »

Scroll to Top