socfortress/Wazuh-Rules
Advanced Wazuh Rules for more accurate threat detection. Feel free to implement within your own Wazuh environment, contribute, or fork!
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
The project lists 11 contributors on GitHub.
Gained 22% fewer stars in the last 90 days than in the 90 days before.
Use Cases & Benefits
- Provides advanced and enriched Wazuh detection rules to improve threat detection accuracy within Wazuh environments.
- Offers more accurate, descriptive, and community-driven rulesets compared to default Wazuh rules, enhancing security monitoring.
- Use for enhancing endpoint detection and response by integrating enriched Sysmon rules for Windows and Linux systems.
- Use for monitoring and detecting threats across cloud services by implementing rules for Office365 and Microsoft Defender logs.
- Use for expanding security analytics by integrating threat intelligence from tools like MISP, Yara, and Suricata within Wazuh.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
No license detected
No license file detected by GitHub: unless the project grants one elsewhere, the default is all rights reserved.
Community files
- README: present
Watch-outs
- Warning: No license file detected by GitHub: unless the project grants one elsewhere, you generally have no permission to use, modify or distribute the code.
- No commits in the last six months (last push Mar 2026).
General guidance from repository metadata, not legal advice. How we score
From the README
The SOCFortress Team has committed to contributing to the Open Source community. We hope you find these rulesets helpful and robust as you work to keep your networks secure.
Advanced Wazuh Detection Rules
The objective for this repo is to provide the Wazuh community with rulesets that are more accurate, descriptive, and enriched from various sources and integrations.
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
Forks
321+7
Open issues
35+4
Compared with peers in Backend
Fastest-growing repositories GStars tracks in this cohort for the week of Nov 1, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| anthropics/skills | 187.8K | +2.9K | 15 | — |
| DuarteSantos8/openGym | 19.7K | +2.4K | 60 | 2 days ago |
| shiyu-coder/Kronos | 47.0K | +2.3K | 16 | — |
| NationalSecurityAgency/ghidra | 98.2K | +2.3K | 64 | 14 days ago |
| microsoft/VibeVoice | 56.0K | +1.1K | 29 | — |
| socfortress/Wazuh-Rules | 1.4K | — | 12 | — |
| Category median | 56.0K | +2.3K | 29 | — |
Discover Repositories
Search across tracked repositories by name or description