Summary of Custom Wazuh Rulesets on GitHub

Below is a personal collection of custom Wazuh rulesets gathered from various community and organizational sources. These rules can be used for reference, customization, or direct application in your own setup. Using this ruleset will provide you with additional rules to use, reducing the time needed to rewrite them and the time spent parsing logs.

Featured Rulesets

• SOCFortress/Wazuh-Rules: Advanced Wazuh Rules for more accurate threat detection. Feel free to implement within your own Wazuh environment, contribute, or fork!

• TristanGNS/wazuh-cjis-rules: Modular CJIS Compliance Ruleset for Wazuh. A maintainable, version-controlled collection of custom Wazuh rules mapped to CJIS Security Policy controls. Designed for easy auditing, deployment, and integration with SIEM workflows.

• sametsazak/sysmon: Sysmon and wazuh integration with Sigma sysmon rules [updated]

• MikhailKasimov/maltrail-wazuh-decoder-and-rules: Maltrail decoder and rules for Wazuh

• TheMuntu/Wazuh-Detection: This is a collection of various Wazuh detection rules for vulnerabilities, malware and adversary emulations.

We have also collected and created some rules ourselves and shared them with the community at the link below. What sets us apart is that we filter out obsolete rules and keep them updated over time.

• FMI Wazuh Rule: hawkteam404/Wazuh

Comparison Table of Main Features