socfortress/Wazuh-Rules resource

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1381 stars · 317 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

A community-maintained collection of advanced Wazuh detection rulesets that improve on Wazuh's default rules for more accurate threat detection. It is maintained by SOCFortress and intended to be dropped into an existing Wazuh SIEM environment.

Use cases

• improve wazuh threat detection accuracy
• find better detection rules for my wazuh siem
• reduce false positives in wazuh alerts
• get community rulesets for open-source siem
• detect threats with wazuh edr agent
• enrich wazuh alerts with more descriptive rules

When to choose

• you already run Wazuh and find the default ruleset too lax
• you want a free, community-driven, regularly updated ruleset
• you want more descriptive and enriched alerts from various log sources and integrations

When to avoid

• you don't use Wazuh or an open-source SIEM
• you need a supported, licensed enterprise detection product with vendor guarantees
• you need rules for a different SIEM like Splunk or Elastic

Facets

dataset · maturity active

security monitoring alerting security monitoring self-hosted wazuh siem detection-rules threat-detection edr soc log-analysis ruleset devops linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="socfortress/Wazuh-Rules")