Rules and Alerts for Wazuh

[GOLASOOO]

Description

The Wazuh platform is up and fully running on AWS, and the fundamental agent connections and macOS compliance modules have been successfully enabled. To fully utilize Wazuh's capabilities, this task involves properly configuring the rules and alerts system. Implementing a well-tuned ruleset and alerting mechanism is critical to ensure that meaningful security events are accurately detected and escalated to the team, while simultaneously minimizing alert fatigue and noise from false positives.

Scope

Included:

• Tuning and configuring the default Wazuh rulesets to match the current infrastructure needs.
• Creating custom rules for specific critical applications, infrastructure components, or custom log sources.
• Configuring alert thresholds and integration with communication channels (e.g., Slack, email, or other incident management tools).
• Validating that alerts are properly categorized by severity and correctly populate the dashboard.

Out of Scope:

• Agent deployments and OS compliance module configuration (already completed).
• Advanced Threat Detection, Continuous Audit, automatic reporting, and overall Dashboard Hardening (these belong to separate tasks).

Acceptance Criteria

• Default Wazuh rules have been reviewed and tuned to reduce false positives.
• Custom rules have been created and applied for any environment-specific requirements.
• Alerting notification channels (e.g., Discord) are successfully integrated and configured.
• Alert levels and thresholds are properly mapped for different types of security events.
• A test alert has been triggered and successfully received via the configured communication channels.

Additional Notes

• Wazuh Ruleset Documentation: https://documentation.wazuh.com/current/user-manual/ruleset/index.html
• Wazuh Alerting Documentation: https://documentation.wazuh.com/current/user-manual/manager/alerting.html
• Before implementing custom rules, review the current log ingestion data on the dashboard to identify the most common noise generators.