├── CHANGELOG.md ├── README.md ├── SECURITY.md ├── VERSION ├── decoders ├── 0005-wazuh_decoders.xml ├── 0006-json_decoders.xml ├── 0010-active-response_decoders.xml ├── 0015-aix-ipsec_decoders.xml ├── 0025-apache_decoders.xml ├── 0030-arpwatch_decoders.xml ├── 0035-asterisk_decoders.xml ├── 0040-auditd_decoders.xml ├── 0045-barracuda_decoders.xml ├── 0050-checkpoint_decoders.xml ├── 0051-checkpoint-smart1_decoders.xml ├── 0055-cimserver_decoders.xml ├── 0060-cisco-estreamer_decoders.xml ├── 0064-cisco-asa_decoders.xml ├── 0065-cisco-ios_decoders.xml ├── 0070-cisco-vpn_decoders.xml ├── 0075-clamav_decoders.xml ├── 0080-courier_decoders.xml ├── 0085-dovecot_decoders.xml ├── 0090-dragon-nids_decoders.xml ├── 0095-dropbear_decoders.xml ├── 0100-fortigate_decoders.xml ├── 0105-freeipa_decoders.xml ├── 0110-ftpd_decoders.xml ├── 0115-grandstream_decoders.xml ├── 0120-horde_decoders.xml ├── 0125-hp_decoders.xml ├── 0130-imapd_decoders.xml ├── 0135-imperva_decoders.xml ├── 0140-kernel_decoders.xml ├── 0145-mailscanner_decoders.xml ├── 0150-mysql_decoders.xml ├── 0155-named_decoders.xml ├── 0160-netscaler_decoders.xml ├── 0165-netscreen_decoders.xml ├── 0170-nginx_decoders.xml ├── 0175-ntpd_decoders.xml ├── 0180-openbsd_decoders.xml ├── 0185-openldap_decoders.xml ├── 0190-openvpn_decoders.xml ├── 0195-oscap_decoders.xml ├── 0200-ossec_decoders.xml ├── 0205-pam_decoders.xml ├── 0210-pix_decoders.xml ├── 0215-portsentry_decoders.xml ├── 0220-postfix_decoders.xml ├── 0225-postgresql_decoders.xml ├── 0230-proftpd_decoders.xml ├── 0235-puppet_decoders.xml ├── 0240-pure-ftpd_decoders.xml ├── 0245-racoon_decoders.xml ├── 0250-redis_decoders.xml ├── 0255-roundcube_decoders.xml ├── 0260-rsa-auth-manager_decoders.xml ├── 0265-rshd_decoders.xml ├── 0270-samba_decoders.xml ├── 0275-sendmail_decoders.xml ├── 0280-serv-u_decoders.xml ├── 0285-snort_decoders.xml ├── 0290-solaris_decoders.xml ├── 0295-sonicwall_decoders.xml ├── 0300-sophos_decoders.xml ├── 0305-squid_decoders.xml ├── 0310-ssh_decoders.xml ├── 0315-su_decoders.xml ├── 0320-sudo_decoders.xml ├── 0325-suhosin_decoders.xml ├── 0330-symantec_decoders.xml ├── 0335-telnet_decoders.xml ├── 0340-trend-osce_decoders.xml ├── 0345-unbound_decoders.xml ├── 0350-unix_decoders.xml ├── 0355-vm-pop3_decoders.xml ├── 0360-vmware_decoders.xml ├── 0365-vpopmail_decoders.xml ├── 0370-vsftpd_decoders.xml ├── 0375-web-accesslog_decoders.xml ├── 0378-mariadb_decoders.xml ├── 0379-dpkg_decoders.xml ├── 0380-windows_decoders.xml ├── 0385-wordpress_decoders.xml ├── 0390-zeus_decoders.xml ├── 0395-sqlserver_decoders.xml ├── 0400-identity_guard_decoders.xml ├── 0405-mongodb_decoders.xml ├── 0410-docker_decoders.xml ├── 0415-jenkins_decoders.xml ├── 0420-vshell_decoders.xml ├── 0425-qualysguard_decoders.xml ├── 0430-cylance_decoders.xml ├── 0435-owncloud_decoders.xml ├── 0440-proxmox-ve_decoders.xml ├── 0445-exim_decoders.xml ├── 0450-openvas_decoders.xml ├── 0455-pfsense_decoders.xml ├── 0460-kaspersky_decoders.xml ├── 0465-azure_decoders.xml ├── 0470-panda-paps_decoders.xml ├── 0475-mcafee_decoders.xml ├── 0480-perdition_decoders.xml ├── 0485-nextcloud_decoders.xml ├── 0490-junos_decoders.xml ├── 0500-macos-sshd_decoders.xml └── 0505-paloalto_decoders.xml ├── lists ├── amazon │ ├── aws-eventnames │ └── aws-sources ├── audit-keys └── security-eventchannel ├── rootchecks ├── cis_apache2224_rcl.txt ├── cis_debian_linux_rcl.txt ├── cis_mysql5-6_community_rcl.txt ├── cis_mysql5-6_enterprise_rcl.txt ├── cis_rhel5_linux_rcl.txt ├── cis_rhel6_linux_rcl.txt ├── cis_rhel7_linux_rcl.txt ├── cis_rhel_linux_rcl.txt ├── cis_sles11_linux_rcl.txt ├── cis_sles12_linux_rcl.txt ├── cis_win2012r2_domainL1_rcl.txt ├── cis_win2012r2_domainL2_rcl.txt ├── cis_win2012r2_memberL1_rcl.txt ├── cis_win2012r2_memberL2_rcl.txt ├── rootkit_files.txt ├── rootkit_trojans.txt ├── system_audit_rcl.txt ├── system_audit_ssh.txt ├── win_applications_rcl.txt ├── win_audit_rcl.txt └── win_malware_rcl.txt ├── rules ├── 0010-rules_config.xml ├── 0015-ossec_rules.xml ├── 0016-wazuh_rules.xml ├── 0020-syslog_rules.xml ├── 0025-sendmail_rules.xml ├── 0030-postfix_rules.xml ├── 0035-spamd_rules.xml ├── 0040-imapd_rules.xml ├── 0045-mailscanner_rules.xml ├── 0050-ms-exchange_rules.xml ├── 0055-courier_rules.xml ├── 0060-firewall_rules.xml ├── 0065-pix_rules.xml ├── 0070-netscreenfw_rules.xml ├── 0075-cisco-ios_rules.xml ├── 0080-sonicwall_rules.xml ├── 0085-pam_rules.xml ├── 0090-telnetd_rules.xml ├── 0095-sshd_rules.xml ├── 0100-solaris_bsm_rules.xml ├── 0105-asterisk_rules.xml ├── 0110-ms_dhcp_rules.xml ├── 0115-arpwatch_rules.xml ├── 0120-symantec-av_rules.xml ├── 0125-symantec-ws_rules.xml ├── 0130-trend-osce_rules.xml ├── 0135-hordeimp_rules.xml ├── 0140-roundcube_rules.xml ├── 0145-wordpress_rules.xml ├── 0150-cimserver_rules.xml ├── 0155-dovecot_rules.xml ├── 0160-vmpop3d_rules.xml ├── 0165-vpopmail_rules.xml ├── 0170-ftpd_rules.xml ├── 0175-proftpd_rules.xml ├── 0180-pure-ftpd_rules.xml ├── 0185-vsftpd_rules.xml ├── 0190-ms_ftpd_rules.xml ├── 0195-named_rules.xml ├── 0200-smbd_rules.xml ├── 0205-racoon_rules.xml ├── 0210-vpn_concentrator_rules.xml ├── 0215-policy_rules.xml ├── 0220-msauth_rules.xml ├── 0225-mcafee_av_rules.xml ├── 0230-ms-se_rules.xml ├── 0235-vmware_rules.xml ├── 0240-ids_rules.xml ├── 0245-web_rules.xml ├── 0250-apache_rules.xml ├── 0255-zeus_rules.xml ├── 0260-nginx_rules.xml ├── 0265-php_rules.xml ├── 0270-web_appsec_rules.xml ├── 0275-squid_rules.xml ├── 0280-attack_rules.xml ├── 0285-systemd_rules.xml ├── 0290-firewalld_rules.xml ├── 0295-mysql_rules.xml ├── 0300-postgresql_rules.xml ├── 0305-dropbear_rules.xml ├── 0310-openbsd_rules.xml ├── 0315-apparmor_rules.xml ├── 0320-clam_av_rules.xml ├── 0325-opensmtpd_rules.xml ├── 0330-sysmon_rules.xml ├── 0335-unbound_rules.xml ├── 0340-puppet_rules.xml ├── 0345-netscaler_rules.xml ├── 0350-amazon_rules.xml ├── 0360-serv-u_rules.xml ├── 0365-auditd_rules.xml ├── 0375-usb_rules.xml ├── 0380-redis_rules.xml ├── 0385-oscap_rules.xml ├── 0390-fortigate_rules.xml ├── 0395-hp_rules.xml ├── 0400-openvpn_rules.xml ├── 0405-rsa-auth-manager_rules.xml ├── 0410-imperva_rules.xml ├── 0415-sophos_rules.xml ├── 0420-freeipa_rules.xml ├── 0425-cisco-estreamer_rules.xml ├── 0430-ms_wdefender_rules.xml ├── 0435-ms_logs_rules.xml ├── 0440-ms_sqlserver_rules.xml ├── 0445-identity_guard_rules.xml ├── 0450-mongodb_rules.xml ├── 0455-docker_rules.xml ├── 0460-jenkins_rules.xml ├── 0470-vshell_rules.xml ├── 0475-suricata_rules.xml ├── 0480-qualysguard_rules.xml ├── 0485-cylance_rules.xml ├── 0490-virustotal_rules.xml ├── 0495-proxmox-ve_rules.xml ├── 0500-owncloud_rules.xml ├── 0505-vuls_rules.xml ├── 0510-ciscat_rules.xml ├── 0515-exim_rules.xml ├── 0520-vulnerability-detector_rules.xml ├── 0525-openvas_rules.xml ├── 0530-mysql_audit_rules.xml ├── 0535-mariadb_rules.xml ├── 0540-pfsense_rules.xml ├── 0545-osquery_rules.xml ├── 0550-kaspersky_rules.xml ├── 0555-azure_rules.xml ├── 0560-docker_integration_rules.xml ├── 0565-ms_ipsec_rules.xml ├── 0570-sca_rules.xml ├── 0575-win-base_rules.xml ├── 0580-win-security_rules.xml ├── 0585-win-application_rules.xml ├── 0590-win-system_rules.xml ├── 0595-win-sysmon_rules.xml ├── 0600-win-wdefender_rules.xml ├── 0601-win-vipre_rules.xml ├── 0602-win-wfirewall_rules.xml ├── 0605-win-mcafee_rules.xml ├── 0610-win-ms_logs_rules.xml ├── 0615-win-ms-se_rules.xml ├── 0620-win-generic_rules.xml ├── 0625-cisco-asa_rules.xml ├── 0625-mcafee_epo_rules.xml ├── 0630-nextcloud_rules.xml ├── 0635-owlh-zeek_rules.xml ├── 0640-junos_rules.xml ├── 0675-panda-paps_rules.xml ├── 0680-checkpoint-smart1_rules.xml ├── 0685-macos-sshd_rules.xml ├── 0690-gcp_rules.xml ├── 0700-paloalto_rules.xml ├── log-entries │ ├── 101 │ ├── 201 │ ├── 202 │ ├── 204 │ ├── 301 │ ├── 401 │ ├── 403 │ ├── 408 │ ├── 409 │ ├── 1101 │ ├── 1401 │ ├── 1402 │ ├── 1602 │ ├── 1603 │ ├── 1607 │ ├── 1609 │ ├── 1901 │ ├── 1902 │ ├── 1903 │ ├── 1905 │ ├── 2501 │ ├── 2601 │ ├── 1301_1302_1303 │ ├── access-control │ ├── apache-error.logs │ ├── cisco-ios-ids │ ├── ciscoios │ ├── ftpd │ ├── iis6 │ ├── imapd │ ├── kernel │ ├── mail-alerts │ ├── mail-errors │ ├── ns1 │ ├── postfix.ini │ ├── proftpd │ ├── smbd │ ├── spamd │ ├── sshd │ ├── symantecws │ ├── telnetd │ ├── unkown │ ├── vpn.log │ ├── vpopmail │ ├── worms │ └── xferlog └── translated │ └── pure_ftpd │ ├── pure-ftpd_rules_da.xml │ ├── pure-ftpd_rules_de.xml │ ├── pure-ftpd_rules_en.xml │ ├── pure-ftpd_rules_es.xml │ ├── pure-ftpd_rules_fr.xml │ ├── pure-ftpd_rules_fr_funny.xml │ ├── pure-ftpd_rules_it.xml │ ├── pure-ftpd_rules_nl.xml │ ├── pure-ftpd_rules_no.xml │ ├── pure-ftpd_rules_pt_br.xml │ ├── pure-ftpd_rules_ro.xml │ ├── pure-ftpd_rules_sk.xml │ ├── pure-ftpd_rules_sv.xml │ └── pure-ftpd_rules_tr.xml ├── rules_reference.md ├── sca ├── applications │ ├── cis_apache_24.yml │ ├── cis_mysql5-6_community.yml │ ├── cis_mysql5-6_enterprise.yml │ ├── cis_sqlserver_2012.yml │ ├── cis_sqlserver_2014.yml │ ├── cis_sqlserver_2017.yml │ ├── cis_sqlserver_2019.yml │ └── web_vulnerabilities.yml ├── centos │ ├── 6 │ │ └── cis_centos6_linux.yml │ ├── 7 │ │ └── cis_centos7_linux.yml │ └── 8 │ │ └── cis_centos8_linux.yml ├── darwin │ ├── 15 │ │ └── cis_apple_macOS_10.11.yml │ ├── 16 │ │ └── cis_apple_macOS_10.12.yml │ └── 17 │ │ └── cis_apple_macOS_10.13.yml ├── debian │ ├── cis_debian10.yml │ ├── cis_debian7.yml │ ├── cis_debian8.yml │ └── cis_debian9.yml ├── generic │ └── sca_unix_audit.yml ├── rhel │ ├── 5 │ │ └── cis_rhel5_linux.yml │ ├── 6 │ │ └── cis_rhel6_linux.yml │ ├── 7 │ │ └── cis_rhel7_linux.yml │ └── 8 │ │ └── cis_rhel8_linux.yml ├── sles │ ├── 11 │ │ └── cis_sles11_linux.yml │ └── 12 │ │ └── cis_sles12_linux.yml ├── sunos │ └── cis_solaris11.yml └── windows │ ├── cis_win10_enterprise.yml │ ├── cis_win2012r2.yml │ ├── cis_win2016.yml │ ├── cis_win2019.yml │ └── sca_win_audit.yml ├── scap_content ├── cve-debian-8-oval.xml ├── cve-debian-9-oval.xml ├── cve-redhat-6-ds.xml ├── cve-redhat-7-ds.xml ├── cve-ubuntu-xenial-oval.xml ├── ssg-centos-6-ds.xml ├── ssg-centos-7-ds.xml ├── ssg-debian-8-ds.xml ├── ssg-fedora-24-ds.xml ├── ssg-rhel-6-ds.xml ├── ssg-rhel-7-ds.xml ├── ssg-ubuntu-1404-ds.xml └── ssg-ubuntu-1604-ds.xml ├── tools ├── amazon │ └── getawslog.py ├── cve-xccdf │ ├── cve-xccdf-update.sh │ ├── oval-to-xccdf.xslt │ └── xccdf_1.1_to_1.2.xsl ├── file-testing │ └── file_test.py ├── map-security-standard │ ├── map_standard.py │ └── map_standard_yaml.py └── rules-testing │ ├── decoders │ ├── test_expr_negation_decoders.xml │ ├── test_osmatch_regex_decoders.xml │ ├── test_osregex_regex_decoders.xml │ ├── test_pcre2_regex_decoders.xml │ └── test_static_filters_decoders.xml │ ├── rules │ ├── test_expr_negation_geoip_rules.xml │ ├── test_expr_negation_rules.xml │ ├── test_osmatch_regex_rules.xml │ ├── test_osregex_regex_geoip_rules.xml │ ├── test_osregex_regex_rules.xml │ ├── test_pcre2_regex_geoip_rules.xml │ ├── test_pcre2_regex_rules.xml │ └── test_static_filters_rules.xml │ ├── runtests.py │ └── tests │ ├── SonicWall.ini │ ├── apache.ini │ ├── apparmor.ini │ ├── checkpoint_smart1.ini │ ├── cimserver.ini │ ├── cisco_asa.ini │ ├── cisco_ios.ini │ ├── cpanel.ini │ ├── doas.ini │ ├── dovecot.ini │ ├── exim.ini │ ├── firewalld.ini │ ├── junos.ini │ ├── macos-sshd.ini │ ├── mailscanner.ini │ ├── mcafee_epo.ini │ ├── modsecurity.ini │ ├── named.ini │ ├── netscreen.ini │ ├── nextcloud.ini │ ├── nginx.ini │ ├── opensmtpd.ini │ ├── openvpn_ldap.ini │ ├── oscap.ini │ ├── ossec.ini │ ├── owlh.ini │ ├── paloalto.ini │ ├── pam.ini │ ├── panda_paps.ini │ ├── postfix.ini │ ├── proftpd.ini │ ├── rsh.ini │ ├── samba.ini │ ├── squid_rules.ini │ ├── sshd.ini │ ├── su.ini │ ├── sudo.ini │ ├── syslog.ini │ ├── sysmon.ini │ ├── systemd.ini │ ├── test_expr_negation.ini │ ├── test_expr_negation_geoip.ini │ ├── test_features.ini │ ├── test_osmatch_regex.ini │ ├── test_osregex_regex.ini │ ├── test_osregex_regex_geoip.ini │ ├── test_pcre2_regex.ini │ ├── test_pcre2_regex_geoip.ini │ ├── test_static_filters.ini │ ├── test_static_filters_geoip.ini │ ├── unbound.ini │ ├── vsftpd.ini │ ├── web_appsec.ini │ └── web_rules.ini └── update_ruleset /CHANGELOG.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/CHANGELOG.md -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/README.md -------------------------------------------------------------------------------- /SECURITY.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/SECURITY.md -------------------------------------------------------------------------------- /VERSION: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/VERSION -------------------------------------------------------------------------------- /decoders/0005-wazuh_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0005-wazuh_decoders.xml -------------------------------------------------------------------------------- /decoders/0006-json_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0006-json_decoders.xml -------------------------------------------------------------------------------- /decoders/0010-active-response_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0010-active-response_decoders.xml -------------------------------------------------------------------------------- /decoders/0015-aix-ipsec_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0015-aix-ipsec_decoders.xml -------------------------------------------------------------------------------- /decoders/0025-apache_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0025-apache_decoders.xml -------------------------------------------------------------------------------- /decoders/0030-arpwatch_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0030-arpwatch_decoders.xml -------------------------------------------------------------------------------- /decoders/0035-asterisk_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0035-asterisk_decoders.xml -------------------------------------------------------------------------------- /decoders/0040-auditd_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0040-auditd_decoders.xml -------------------------------------------------------------------------------- /decoders/0045-barracuda_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0045-barracuda_decoders.xml -------------------------------------------------------------------------------- /decoders/0050-checkpoint_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0050-checkpoint_decoders.xml -------------------------------------------------------------------------------- /decoders/0051-checkpoint-smart1_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0051-checkpoint-smart1_decoders.xml -------------------------------------------------------------------------------- /decoders/0055-cimserver_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0055-cimserver_decoders.xml -------------------------------------------------------------------------------- /decoders/0060-cisco-estreamer_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0060-cisco-estreamer_decoders.xml -------------------------------------------------------------------------------- /decoders/0064-cisco-asa_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0064-cisco-asa_decoders.xml -------------------------------------------------------------------------------- /decoders/0065-cisco-ios_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0065-cisco-ios_decoders.xml -------------------------------------------------------------------------------- /decoders/0070-cisco-vpn_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0070-cisco-vpn_decoders.xml -------------------------------------------------------------------------------- /decoders/0075-clamav_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0075-clamav_decoders.xml -------------------------------------------------------------------------------- /decoders/0080-courier_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0080-courier_decoders.xml -------------------------------------------------------------------------------- /decoders/0085-dovecot_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0085-dovecot_decoders.xml -------------------------------------------------------------------------------- /decoders/0090-dragon-nids_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0090-dragon-nids_decoders.xml -------------------------------------------------------------------------------- /decoders/0095-dropbear_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0095-dropbear_decoders.xml -------------------------------------------------------------------------------- /decoders/0100-fortigate_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0100-fortigate_decoders.xml -------------------------------------------------------------------------------- /decoders/0105-freeipa_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0105-freeipa_decoders.xml -------------------------------------------------------------------------------- /decoders/0110-ftpd_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0110-ftpd_decoders.xml -------------------------------------------------------------------------------- /decoders/0115-grandstream_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0115-grandstream_decoders.xml -------------------------------------------------------------------------------- /decoders/0120-horde_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0120-horde_decoders.xml -------------------------------------------------------------------------------- /decoders/0125-hp_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0125-hp_decoders.xml -------------------------------------------------------------------------------- /decoders/0130-imapd_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0130-imapd_decoders.xml -------------------------------------------------------------------------------- /decoders/0135-imperva_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0135-imperva_decoders.xml -------------------------------------------------------------------------------- /decoders/0140-kernel_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0140-kernel_decoders.xml -------------------------------------------------------------------------------- /decoders/0145-mailscanner_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0145-mailscanner_decoders.xml -------------------------------------------------------------------------------- /decoders/0150-mysql_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0150-mysql_decoders.xml -------------------------------------------------------------------------------- /decoders/0155-named_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0155-named_decoders.xml -------------------------------------------------------------------------------- /decoders/0160-netscaler_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0160-netscaler_decoders.xml -------------------------------------------------------------------------------- /decoders/0165-netscreen_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0165-netscreen_decoders.xml -------------------------------------------------------------------------------- /decoders/0170-nginx_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0170-nginx_decoders.xml -------------------------------------------------------------------------------- /decoders/0175-ntpd_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0175-ntpd_decoders.xml -------------------------------------------------------------------------------- /decoders/0180-openbsd_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0180-openbsd_decoders.xml -------------------------------------------------------------------------------- /decoders/0185-openldap_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0185-openldap_decoders.xml -------------------------------------------------------------------------------- /decoders/0190-openvpn_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0190-openvpn_decoders.xml -------------------------------------------------------------------------------- /decoders/0195-oscap_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0195-oscap_decoders.xml -------------------------------------------------------------------------------- /decoders/0200-ossec_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0200-ossec_decoders.xml -------------------------------------------------------------------------------- /decoders/0205-pam_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0205-pam_decoders.xml -------------------------------------------------------------------------------- /decoders/0210-pix_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0210-pix_decoders.xml -------------------------------------------------------------------------------- /decoders/0215-portsentry_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0215-portsentry_decoders.xml -------------------------------------------------------------------------------- /decoders/0220-postfix_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0220-postfix_decoders.xml -------------------------------------------------------------------------------- /decoders/0225-postgresql_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0225-postgresql_decoders.xml -------------------------------------------------------------------------------- /decoders/0230-proftpd_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0230-proftpd_decoders.xml -------------------------------------------------------------------------------- /decoders/0235-puppet_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0235-puppet_decoders.xml -------------------------------------------------------------------------------- /decoders/0240-pure-ftpd_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0240-pure-ftpd_decoders.xml -------------------------------------------------------------------------------- /decoders/0245-racoon_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0245-racoon_decoders.xml -------------------------------------------------------------------------------- /decoders/0250-redis_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0250-redis_decoders.xml -------------------------------------------------------------------------------- /decoders/0255-roundcube_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0255-roundcube_decoders.xml -------------------------------------------------------------------------------- /decoders/0260-rsa-auth-manager_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0260-rsa-auth-manager_decoders.xml -------------------------------------------------------------------------------- /decoders/0265-rshd_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0265-rshd_decoders.xml -------------------------------------------------------------------------------- /decoders/0270-samba_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0270-samba_decoders.xml -------------------------------------------------------------------------------- /decoders/0275-sendmail_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0275-sendmail_decoders.xml -------------------------------------------------------------------------------- /decoders/0280-serv-u_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0280-serv-u_decoders.xml -------------------------------------------------------------------------------- /decoders/0285-snort_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0285-snort_decoders.xml -------------------------------------------------------------------------------- /decoders/0290-solaris_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0290-solaris_decoders.xml -------------------------------------------------------------------------------- /decoders/0295-sonicwall_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0295-sonicwall_decoders.xml -------------------------------------------------------------------------------- /decoders/0300-sophos_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0300-sophos_decoders.xml -------------------------------------------------------------------------------- /decoders/0305-squid_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0305-squid_decoders.xml -------------------------------------------------------------------------------- /decoders/0310-ssh_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0310-ssh_decoders.xml -------------------------------------------------------------------------------- /decoders/0315-su_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0315-su_decoders.xml -------------------------------------------------------------------------------- /decoders/0320-sudo_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0320-sudo_decoders.xml -------------------------------------------------------------------------------- /decoders/0325-suhosin_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0325-suhosin_decoders.xml -------------------------------------------------------------------------------- /decoders/0330-symantec_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0330-symantec_decoders.xml -------------------------------------------------------------------------------- /decoders/0335-telnet_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0335-telnet_decoders.xml -------------------------------------------------------------------------------- /decoders/0340-trend-osce_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0340-trend-osce_decoders.xml -------------------------------------------------------------------------------- /decoders/0345-unbound_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0345-unbound_decoders.xml -------------------------------------------------------------------------------- /decoders/0350-unix_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0350-unix_decoders.xml -------------------------------------------------------------------------------- /decoders/0355-vm-pop3_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0355-vm-pop3_decoders.xml -------------------------------------------------------------------------------- /decoders/0360-vmware_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0360-vmware_decoders.xml -------------------------------------------------------------------------------- /decoders/0365-vpopmail_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0365-vpopmail_decoders.xml -------------------------------------------------------------------------------- /decoders/0370-vsftpd_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0370-vsftpd_decoders.xml -------------------------------------------------------------------------------- /decoders/0375-web-accesslog_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0375-web-accesslog_decoders.xml -------------------------------------------------------------------------------- /decoders/0378-mariadb_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0378-mariadb_decoders.xml -------------------------------------------------------------------------------- /decoders/0379-dpkg_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0379-dpkg_decoders.xml -------------------------------------------------------------------------------- /decoders/0380-windows_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0380-windows_decoders.xml -------------------------------------------------------------------------------- /decoders/0385-wordpress_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0385-wordpress_decoders.xml -------------------------------------------------------------------------------- /decoders/0390-zeus_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0390-zeus_decoders.xml -------------------------------------------------------------------------------- /decoders/0395-sqlserver_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0395-sqlserver_decoders.xml -------------------------------------------------------------------------------- /decoders/0400-identity_guard_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0400-identity_guard_decoders.xml -------------------------------------------------------------------------------- /decoders/0405-mongodb_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0405-mongodb_decoders.xml -------------------------------------------------------------------------------- /decoders/0410-docker_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0410-docker_decoders.xml -------------------------------------------------------------------------------- /decoders/0415-jenkins_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0415-jenkins_decoders.xml -------------------------------------------------------------------------------- /decoders/0420-vshell_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0420-vshell_decoders.xml -------------------------------------------------------------------------------- /decoders/0425-qualysguard_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0425-qualysguard_decoders.xml -------------------------------------------------------------------------------- /decoders/0430-cylance_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0430-cylance_decoders.xml -------------------------------------------------------------------------------- /decoders/0435-owncloud_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0435-owncloud_decoders.xml -------------------------------------------------------------------------------- /decoders/0440-proxmox-ve_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0440-proxmox-ve_decoders.xml -------------------------------------------------------------------------------- /decoders/0445-exim_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0445-exim_decoders.xml -------------------------------------------------------------------------------- /decoders/0450-openvas_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0450-openvas_decoders.xml -------------------------------------------------------------------------------- /decoders/0455-pfsense_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0455-pfsense_decoders.xml -------------------------------------------------------------------------------- /decoders/0460-kaspersky_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0460-kaspersky_decoders.xml -------------------------------------------------------------------------------- /decoders/0465-azure_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0465-azure_decoders.xml -------------------------------------------------------------------------------- /decoders/0470-panda-paps_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0470-panda-paps_decoders.xml -------------------------------------------------------------------------------- /decoders/0475-mcafee_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0475-mcafee_decoders.xml -------------------------------------------------------------------------------- /decoders/0480-perdition_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0480-perdition_decoders.xml -------------------------------------------------------------------------------- /decoders/0485-nextcloud_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0485-nextcloud_decoders.xml -------------------------------------------------------------------------------- /decoders/0490-junos_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0490-junos_decoders.xml -------------------------------------------------------------------------------- /decoders/0500-macos-sshd_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0500-macos-sshd_decoders.xml -------------------------------------------------------------------------------- /decoders/0505-paloalto_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/decoders/0505-paloalto_decoders.xml -------------------------------------------------------------------------------- /lists/amazon/aws-eventnames: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/lists/amazon/aws-eventnames -------------------------------------------------------------------------------- /lists/amazon/aws-sources: -------------------------------------------------------------------------------- 1 | TEMPLATE:# Filtering by Cloudtrail sources is no longer used. 2 | -------------------------------------------------------------------------------- /lists/audit-keys: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/lists/audit-keys -------------------------------------------------------------------------------- /lists/security-eventchannel: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/lists/security-eventchannel -------------------------------------------------------------------------------- /rootchecks/cis_apache2224_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_apache2224_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_debian_linux_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_debian_linux_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_mysql5-6_community_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_mysql5-6_community_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_mysql5-6_enterprise_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_mysql5-6_enterprise_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_rhel5_linux_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_rhel5_linux_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_rhel6_linux_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_rhel6_linux_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_rhel7_linux_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_rhel7_linux_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_rhel_linux_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_rhel_linux_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_sles11_linux_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_sles11_linux_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_sles12_linux_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_sles12_linux_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_win2012r2_domainL1_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_win2012r2_domainL1_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_win2012r2_domainL2_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_win2012r2_domainL2_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_win2012r2_memberL1_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_win2012r2_memberL1_rcl.txt -------------------------------------------------------------------------------- /rootchecks/cis_win2012r2_memberL2_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/cis_win2012r2_memberL2_rcl.txt -------------------------------------------------------------------------------- /rootchecks/rootkit_files.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/rootkit_files.txt -------------------------------------------------------------------------------- /rootchecks/rootkit_trojans.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/rootkit_trojans.txt -------------------------------------------------------------------------------- /rootchecks/system_audit_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/system_audit_rcl.txt -------------------------------------------------------------------------------- /rootchecks/system_audit_ssh.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/system_audit_ssh.txt -------------------------------------------------------------------------------- /rootchecks/win_applications_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/win_applications_rcl.txt -------------------------------------------------------------------------------- /rootchecks/win_audit_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/win_audit_rcl.txt -------------------------------------------------------------------------------- /rootchecks/win_malware_rcl.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rootchecks/win_malware_rcl.txt -------------------------------------------------------------------------------- /rules/0010-rules_config.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0010-rules_config.xml -------------------------------------------------------------------------------- /rules/0015-ossec_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0015-ossec_rules.xml -------------------------------------------------------------------------------- /rules/0016-wazuh_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0016-wazuh_rules.xml -------------------------------------------------------------------------------- /rules/0020-syslog_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0020-syslog_rules.xml -------------------------------------------------------------------------------- /rules/0025-sendmail_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0025-sendmail_rules.xml -------------------------------------------------------------------------------- /rules/0030-postfix_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0030-postfix_rules.xml -------------------------------------------------------------------------------- /rules/0035-spamd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0035-spamd_rules.xml -------------------------------------------------------------------------------- /rules/0040-imapd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0040-imapd_rules.xml -------------------------------------------------------------------------------- /rules/0045-mailscanner_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0045-mailscanner_rules.xml -------------------------------------------------------------------------------- /rules/0050-ms-exchange_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0050-ms-exchange_rules.xml -------------------------------------------------------------------------------- /rules/0055-courier_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0055-courier_rules.xml -------------------------------------------------------------------------------- /rules/0060-firewall_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0060-firewall_rules.xml -------------------------------------------------------------------------------- /rules/0065-pix_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0065-pix_rules.xml -------------------------------------------------------------------------------- /rules/0070-netscreenfw_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0070-netscreenfw_rules.xml -------------------------------------------------------------------------------- /rules/0075-cisco-ios_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0075-cisco-ios_rules.xml -------------------------------------------------------------------------------- /rules/0080-sonicwall_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0080-sonicwall_rules.xml -------------------------------------------------------------------------------- /rules/0085-pam_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0085-pam_rules.xml -------------------------------------------------------------------------------- /rules/0090-telnetd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0090-telnetd_rules.xml -------------------------------------------------------------------------------- /rules/0095-sshd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0095-sshd_rules.xml -------------------------------------------------------------------------------- /rules/0100-solaris_bsm_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0100-solaris_bsm_rules.xml -------------------------------------------------------------------------------- /rules/0105-asterisk_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0105-asterisk_rules.xml -------------------------------------------------------------------------------- /rules/0110-ms_dhcp_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0110-ms_dhcp_rules.xml -------------------------------------------------------------------------------- /rules/0115-arpwatch_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0115-arpwatch_rules.xml -------------------------------------------------------------------------------- /rules/0120-symantec-av_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0120-symantec-av_rules.xml -------------------------------------------------------------------------------- /rules/0125-symantec-ws_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0125-symantec-ws_rules.xml -------------------------------------------------------------------------------- /rules/0130-trend-osce_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0130-trend-osce_rules.xml -------------------------------------------------------------------------------- /rules/0135-hordeimp_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0135-hordeimp_rules.xml -------------------------------------------------------------------------------- /rules/0140-roundcube_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0140-roundcube_rules.xml -------------------------------------------------------------------------------- /rules/0145-wordpress_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0145-wordpress_rules.xml -------------------------------------------------------------------------------- /rules/0150-cimserver_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0150-cimserver_rules.xml -------------------------------------------------------------------------------- /rules/0155-dovecot_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0155-dovecot_rules.xml -------------------------------------------------------------------------------- /rules/0160-vmpop3d_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0160-vmpop3d_rules.xml -------------------------------------------------------------------------------- /rules/0165-vpopmail_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0165-vpopmail_rules.xml -------------------------------------------------------------------------------- /rules/0170-ftpd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0170-ftpd_rules.xml -------------------------------------------------------------------------------- /rules/0175-proftpd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0175-proftpd_rules.xml -------------------------------------------------------------------------------- /rules/0180-pure-ftpd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0180-pure-ftpd_rules.xml -------------------------------------------------------------------------------- /rules/0185-vsftpd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0185-vsftpd_rules.xml -------------------------------------------------------------------------------- /rules/0190-ms_ftpd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0190-ms_ftpd_rules.xml -------------------------------------------------------------------------------- /rules/0195-named_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0195-named_rules.xml -------------------------------------------------------------------------------- /rules/0200-smbd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0200-smbd_rules.xml -------------------------------------------------------------------------------- /rules/0205-racoon_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0205-racoon_rules.xml -------------------------------------------------------------------------------- /rules/0210-vpn_concentrator_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0210-vpn_concentrator_rules.xml -------------------------------------------------------------------------------- /rules/0215-policy_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0215-policy_rules.xml -------------------------------------------------------------------------------- /rules/0220-msauth_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0220-msauth_rules.xml -------------------------------------------------------------------------------- /rules/0225-mcafee_av_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0225-mcafee_av_rules.xml -------------------------------------------------------------------------------- /rules/0230-ms-se_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0230-ms-se_rules.xml -------------------------------------------------------------------------------- /rules/0235-vmware_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0235-vmware_rules.xml -------------------------------------------------------------------------------- /rules/0240-ids_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0240-ids_rules.xml -------------------------------------------------------------------------------- /rules/0245-web_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0245-web_rules.xml -------------------------------------------------------------------------------- /rules/0250-apache_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0250-apache_rules.xml -------------------------------------------------------------------------------- /rules/0255-zeus_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0255-zeus_rules.xml -------------------------------------------------------------------------------- /rules/0260-nginx_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0260-nginx_rules.xml -------------------------------------------------------------------------------- /rules/0265-php_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0265-php_rules.xml -------------------------------------------------------------------------------- /rules/0270-web_appsec_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0270-web_appsec_rules.xml -------------------------------------------------------------------------------- /rules/0275-squid_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0275-squid_rules.xml -------------------------------------------------------------------------------- /rules/0280-attack_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0280-attack_rules.xml -------------------------------------------------------------------------------- /rules/0285-systemd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0285-systemd_rules.xml -------------------------------------------------------------------------------- /rules/0290-firewalld_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0290-firewalld_rules.xml -------------------------------------------------------------------------------- /rules/0295-mysql_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0295-mysql_rules.xml -------------------------------------------------------------------------------- /rules/0300-postgresql_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0300-postgresql_rules.xml -------------------------------------------------------------------------------- /rules/0305-dropbear_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0305-dropbear_rules.xml -------------------------------------------------------------------------------- /rules/0310-openbsd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0310-openbsd_rules.xml -------------------------------------------------------------------------------- /rules/0315-apparmor_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0315-apparmor_rules.xml -------------------------------------------------------------------------------- /rules/0320-clam_av_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0320-clam_av_rules.xml -------------------------------------------------------------------------------- /rules/0325-opensmtpd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0325-opensmtpd_rules.xml -------------------------------------------------------------------------------- /rules/0330-sysmon_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0330-sysmon_rules.xml -------------------------------------------------------------------------------- /rules/0335-unbound_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0335-unbound_rules.xml -------------------------------------------------------------------------------- /rules/0340-puppet_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0340-puppet_rules.xml -------------------------------------------------------------------------------- /rules/0345-netscaler_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0345-netscaler_rules.xml -------------------------------------------------------------------------------- /rules/0350-amazon_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0350-amazon_rules.xml -------------------------------------------------------------------------------- /rules/0360-serv-u_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0360-serv-u_rules.xml -------------------------------------------------------------------------------- /rules/0365-auditd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0365-auditd_rules.xml -------------------------------------------------------------------------------- /rules/0375-usb_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0375-usb_rules.xml -------------------------------------------------------------------------------- /rules/0380-redis_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0380-redis_rules.xml -------------------------------------------------------------------------------- /rules/0385-oscap_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0385-oscap_rules.xml -------------------------------------------------------------------------------- /rules/0390-fortigate_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0390-fortigate_rules.xml -------------------------------------------------------------------------------- /rules/0395-hp_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0395-hp_rules.xml -------------------------------------------------------------------------------- /rules/0400-openvpn_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0400-openvpn_rules.xml -------------------------------------------------------------------------------- /rules/0405-rsa-auth-manager_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0405-rsa-auth-manager_rules.xml -------------------------------------------------------------------------------- /rules/0410-imperva_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0410-imperva_rules.xml -------------------------------------------------------------------------------- /rules/0415-sophos_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0415-sophos_rules.xml -------------------------------------------------------------------------------- /rules/0420-freeipa_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0420-freeipa_rules.xml -------------------------------------------------------------------------------- /rules/0425-cisco-estreamer_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0425-cisco-estreamer_rules.xml -------------------------------------------------------------------------------- /rules/0430-ms_wdefender_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0430-ms_wdefender_rules.xml -------------------------------------------------------------------------------- /rules/0435-ms_logs_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0435-ms_logs_rules.xml -------------------------------------------------------------------------------- /rules/0440-ms_sqlserver_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0440-ms_sqlserver_rules.xml -------------------------------------------------------------------------------- /rules/0445-identity_guard_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0445-identity_guard_rules.xml -------------------------------------------------------------------------------- /rules/0450-mongodb_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0450-mongodb_rules.xml -------------------------------------------------------------------------------- /rules/0455-docker_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0455-docker_rules.xml -------------------------------------------------------------------------------- /rules/0460-jenkins_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0460-jenkins_rules.xml -------------------------------------------------------------------------------- /rules/0470-vshell_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0470-vshell_rules.xml -------------------------------------------------------------------------------- /rules/0475-suricata_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0475-suricata_rules.xml -------------------------------------------------------------------------------- /rules/0480-qualysguard_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0480-qualysguard_rules.xml -------------------------------------------------------------------------------- /rules/0485-cylance_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0485-cylance_rules.xml -------------------------------------------------------------------------------- /rules/0490-virustotal_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0490-virustotal_rules.xml -------------------------------------------------------------------------------- /rules/0495-proxmox-ve_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0495-proxmox-ve_rules.xml -------------------------------------------------------------------------------- /rules/0500-owncloud_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0500-owncloud_rules.xml -------------------------------------------------------------------------------- /rules/0505-vuls_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0505-vuls_rules.xml -------------------------------------------------------------------------------- /rules/0510-ciscat_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0510-ciscat_rules.xml -------------------------------------------------------------------------------- /rules/0515-exim_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0515-exim_rules.xml -------------------------------------------------------------------------------- /rules/0520-vulnerability-detector_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0520-vulnerability-detector_rules.xml -------------------------------------------------------------------------------- /rules/0525-openvas_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0525-openvas_rules.xml -------------------------------------------------------------------------------- /rules/0530-mysql_audit_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0530-mysql_audit_rules.xml -------------------------------------------------------------------------------- /rules/0535-mariadb_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0535-mariadb_rules.xml -------------------------------------------------------------------------------- /rules/0540-pfsense_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0540-pfsense_rules.xml -------------------------------------------------------------------------------- /rules/0545-osquery_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0545-osquery_rules.xml -------------------------------------------------------------------------------- /rules/0550-kaspersky_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0550-kaspersky_rules.xml -------------------------------------------------------------------------------- /rules/0555-azure_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0555-azure_rules.xml -------------------------------------------------------------------------------- /rules/0560-docker_integration_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0560-docker_integration_rules.xml -------------------------------------------------------------------------------- /rules/0565-ms_ipsec_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0565-ms_ipsec_rules.xml -------------------------------------------------------------------------------- /rules/0570-sca_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0570-sca_rules.xml -------------------------------------------------------------------------------- /rules/0575-win-base_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0575-win-base_rules.xml -------------------------------------------------------------------------------- /rules/0580-win-security_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0580-win-security_rules.xml -------------------------------------------------------------------------------- /rules/0585-win-application_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0585-win-application_rules.xml -------------------------------------------------------------------------------- /rules/0590-win-system_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0590-win-system_rules.xml -------------------------------------------------------------------------------- /rules/0595-win-sysmon_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0595-win-sysmon_rules.xml -------------------------------------------------------------------------------- /rules/0600-win-wdefender_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0600-win-wdefender_rules.xml -------------------------------------------------------------------------------- /rules/0601-win-vipre_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0601-win-vipre_rules.xml -------------------------------------------------------------------------------- /rules/0602-win-wfirewall_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0602-win-wfirewall_rules.xml -------------------------------------------------------------------------------- /rules/0605-win-mcafee_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0605-win-mcafee_rules.xml -------------------------------------------------------------------------------- /rules/0610-win-ms_logs_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0610-win-ms_logs_rules.xml -------------------------------------------------------------------------------- /rules/0615-win-ms-se_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0615-win-ms-se_rules.xml -------------------------------------------------------------------------------- /rules/0620-win-generic_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0620-win-generic_rules.xml -------------------------------------------------------------------------------- /rules/0625-cisco-asa_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0625-cisco-asa_rules.xml -------------------------------------------------------------------------------- /rules/0625-mcafee_epo_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0625-mcafee_epo_rules.xml -------------------------------------------------------------------------------- /rules/0630-nextcloud_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0630-nextcloud_rules.xml -------------------------------------------------------------------------------- /rules/0635-owlh-zeek_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0635-owlh-zeek_rules.xml -------------------------------------------------------------------------------- /rules/0640-junos_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0640-junos_rules.xml -------------------------------------------------------------------------------- /rules/0675-panda-paps_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0675-panda-paps_rules.xml -------------------------------------------------------------------------------- /rules/0680-checkpoint-smart1_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0680-checkpoint-smart1_rules.xml -------------------------------------------------------------------------------- /rules/0685-macos-sshd_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0685-macos-sshd_rules.xml -------------------------------------------------------------------------------- /rules/0690-gcp_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0690-gcp_rules.xml -------------------------------------------------------------------------------- /rules/0700-paloalto_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/0700-paloalto_rules.xml -------------------------------------------------------------------------------- /rules/log-entries/101: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/101 -------------------------------------------------------------------------------- /rules/log-entries/1101: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1101 -------------------------------------------------------------------------------- /rules/log-entries/1301_1302_1303: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1301_1302_1303 -------------------------------------------------------------------------------- /rules/log-entries/1401: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1401 -------------------------------------------------------------------------------- /rules/log-entries/1402: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1402 -------------------------------------------------------------------------------- /rules/log-entries/1602: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1602 -------------------------------------------------------------------------------- /rules/log-entries/1603: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1603 -------------------------------------------------------------------------------- /rules/log-entries/1607: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1607 -------------------------------------------------------------------------------- /rules/log-entries/1609: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1609 -------------------------------------------------------------------------------- /rules/log-entries/1901: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1901 -------------------------------------------------------------------------------- /rules/log-entries/1902: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1902 -------------------------------------------------------------------------------- /rules/log-entries/1903: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1903 -------------------------------------------------------------------------------- /rules/log-entries/1905: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/1905 -------------------------------------------------------------------------------- /rules/log-entries/201: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/201 -------------------------------------------------------------------------------- /rules/log-entries/202: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/202 -------------------------------------------------------------------------------- /rules/log-entries/204: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/204 -------------------------------------------------------------------------------- /rules/log-entries/2501: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/2501 -------------------------------------------------------------------------------- /rules/log-entries/2601: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/2601 -------------------------------------------------------------------------------- /rules/log-entries/301: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/301 -------------------------------------------------------------------------------- /rules/log-entries/401: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/401 -------------------------------------------------------------------------------- /rules/log-entries/403: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/403 -------------------------------------------------------------------------------- /rules/log-entries/408: -------------------------------------------------------------------------------- 1 | #Red Hat 2 | Feb 4 16:54:28 niban login[1074]: FAILED LOGIN 1 FROM (null) FOR dcid, Authentication failure 3 | -------------------------------------------------------------------------------- /rules/log-entries/409: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/409 -------------------------------------------------------------------------------- /rules/log-entries/access-control: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/access-control -------------------------------------------------------------------------------- /rules/log-entries/apache-error.logs: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/apache-error.logs -------------------------------------------------------------------------------- /rules/log-entries/cisco-ios-ids: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/cisco-ios-ids -------------------------------------------------------------------------------- /rules/log-entries/ciscoios: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/ciscoios -------------------------------------------------------------------------------- /rules/log-entries/ftpd: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/ftpd -------------------------------------------------------------------------------- /rules/log-entries/iis6: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/iis6 -------------------------------------------------------------------------------- /rules/log-entries/imapd: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/imapd -------------------------------------------------------------------------------- /rules/log-entries/kernel: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/kernel -------------------------------------------------------------------------------- /rules/log-entries/mail-alerts: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/mail-alerts -------------------------------------------------------------------------------- /rules/log-entries/mail-errors: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/mail-errors -------------------------------------------------------------------------------- /rules/log-entries/ns1: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/ns1 -------------------------------------------------------------------------------- /rules/log-entries/postfix.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/postfix.ini -------------------------------------------------------------------------------- /rules/log-entries/proftpd: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/proftpd -------------------------------------------------------------------------------- /rules/log-entries/smbd: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/smbd -------------------------------------------------------------------------------- /rules/log-entries/spamd: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/spamd -------------------------------------------------------------------------------- /rules/log-entries/sshd: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/sshd -------------------------------------------------------------------------------- /rules/log-entries/symantecws: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/symantecws -------------------------------------------------------------------------------- /rules/log-entries/telnetd: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/telnetd -------------------------------------------------------------------------------- /rules/log-entries/unkown: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/unkown -------------------------------------------------------------------------------- /rules/log-entries/vpn.log: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/vpn.log -------------------------------------------------------------------------------- /rules/log-entries/vpopmail: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/vpopmail -------------------------------------------------------------------------------- /rules/log-entries/worms: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/worms -------------------------------------------------------------------------------- /rules/log-entries/xferlog: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/log-entries/xferlog -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_da.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_da.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_de.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_de.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_en.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_en.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_es.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_es.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_fr.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_fr.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_fr_funny.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_fr_funny.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_it.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_it.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_nl.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_nl.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_no.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_no.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_pt_br.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_pt_br.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_ro.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_ro.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_sk.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_sk.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_sv.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_sv.xml -------------------------------------------------------------------------------- /rules/translated/pure_ftpd/pure-ftpd_rules_tr.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules/translated/pure_ftpd/pure-ftpd_rules_tr.xml -------------------------------------------------------------------------------- /rules_reference.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/rules_reference.md -------------------------------------------------------------------------------- /sca/applications/cis_apache_24.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/applications/cis_apache_24.yml -------------------------------------------------------------------------------- /sca/applications/cis_mysql5-6_community.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/applications/cis_mysql5-6_community.yml -------------------------------------------------------------------------------- /sca/applications/cis_mysql5-6_enterprise.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/applications/cis_mysql5-6_enterprise.yml -------------------------------------------------------------------------------- /sca/applications/cis_sqlserver_2012.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/applications/cis_sqlserver_2012.yml -------------------------------------------------------------------------------- /sca/applications/cis_sqlserver_2014.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/applications/cis_sqlserver_2014.yml -------------------------------------------------------------------------------- /sca/applications/cis_sqlserver_2017.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/applications/cis_sqlserver_2017.yml -------------------------------------------------------------------------------- /sca/applications/cis_sqlserver_2019.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/applications/cis_sqlserver_2019.yml -------------------------------------------------------------------------------- /sca/applications/web_vulnerabilities.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/applications/web_vulnerabilities.yml -------------------------------------------------------------------------------- /sca/centos/6/cis_centos6_linux.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/centos/6/cis_centos6_linux.yml -------------------------------------------------------------------------------- /sca/centos/7/cis_centos7_linux.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/centos/7/cis_centos7_linux.yml -------------------------------------------------------------------------------- /sca/centos/8/cis_centos8_linux.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/centos/8/cis_centos8_linux.yml -------------------------------------------------------------------------------- /sca/darwin/15/cis_apple_macOS_10.11.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/darwin/15/cis_apple_macOS_10.11.yml -------------------------------------------------------------------------------- /sca/darwin/16/cis_apple_macOS_10.12.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/darwin/16/cis_apple_macOS_10.12.yml -------------------------------------------------------------------------------- /sca/darwin/17/cis_apple_macOS_10.13.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/darwin/17/cis_apple_macOS_10.13.yml -------------------------------------------------------------------------------- /sca/debian/cis_debian10.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/debian/cis_debian10.yml -------------------------------------------------------------------------------- /sca/debian/cis_debian7.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/debian/cis_debian7.yml -------------------------------------------------------------------------------- /sca/debian/cis_debian8.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/debian/cis_debian8.yml -------------------------------------------------------------------------------- /sca/debian/cis_debian9.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/debian/cis_debian9.yml -------------------------------------------------------------------------------- /sca/generic/sca_unix_audit.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/generic/sca_unix_audit.yml -------------------------------------------------------------------------------- /sca/rhel/5/cis_rhel5_linux.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/rhel/5/cis_rhel5_linux.yml -------------------------------------------------------------------------------- /sca/rhel/6/cis_rhel6_linux.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/rhel/6/cis_rhel6_linux.yml -------------------------------------------------------------------------------- /sca/rhel/7/cis_rhel7_linux.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/rhel/7/cis_rhel7_linux.yml -------------------------------------------------------------------------------- /sca/rhel/8/cis_rhel8_linux.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/rhel/8/cis_rhel8_linux.yml -------------------------------------------------------------------------------- /sca/sles/11/cis_sles11_linux.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/sles/11/cis_sles11_linux.yml -------------------------------------------------------------------------------- /sca/sles/12/cis_sles12_linux.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/sles/12/cis_sles12_linux.yml -------------------------------------------------------------------------------- /sca/sunos/cis_solaris11.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/sunos/cis_solaris11.yml -------------------------------------------------------------------------------- /sca/windows/cis_win10_enterprise.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/windows/cis_win10_enterprise.yml -------------------------------------------------------------------------------- /sca/windows/cis_win2012r2.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/windows/cis_win2012r2.yml -------------------------------------------------------------------------------- /sca/windows/cis_win2016.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/windows/cis_win2016.yml -------------------------------------------------------------------------------- /sca/windows/cis_win2019.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/windows/cis_win2019.yml -------------------------------------------------------------------------------- /sca/windows/sca_win_audit.yml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/sca/windows/sca_win_audit.yml -------------------------------------------------------------------------------- /scap_content/cve-debian-8-oval.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/cve-debian-8-oval.xml -------------------------------------------------------------------------------- /scap_content/cve-debian-9-oval.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/cve-debian-9-oval.xml -------------------------------------------------------------------------------- /scap_content/cve-redhat-6-ds.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/cve-redhat-6-ds.xml -------------------------------------------------------------------------------- /scap_content/cve-redhat-7-ds.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/cve-redhat-7-ds.xml -------------------------------------------------------------------------------- /scap_content/cve-ubuntu-xenial-oval.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/cve-ubuntu-xenial-oval.xml -------------------------------------------------------------------------------- /scap_content/ssg-centos-6-ds.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/ssg-centos-6-ds.xml -------------------------------------------------------------------------------- /scap_content/ssg-centos-7-ds.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/ssg-centos-7-ds.xml -------------------------------------------------------------------------------- /scap_content/ssg-debian-8-ds.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/ssg-debian-8-ds.xml -------------------------------------------------------------------------------- /scap_content/ssg-fedora-24-ds.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/ssg-fedora-24-ds.xml -------------------------------------------------------------------------------- /scap_content/ssg-rhel-6-ds.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/ssg-rhel-6-ds.xml -------------------------------------------------------------------------------- /scap_content/ssg-rhel-7-ds.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/ssg-rhel-7-ds.xml -------------------------------------------------------------------------------- /scap_content/ssg-ubuntu-1404-ds.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/ssg-ubuntu-1404-ds.xml -------------------------------------------------------------------------------- /scap_content/ssg-ubuntu-1604-ds.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/scap_content/ssg-ubuntu-1604-ds.xml -------------------------------------------------------------------------------- /tools/amazon/getawslog.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/amazon/getawslog.py -------------------------------------------------------------------------------- /tools/cve-xccdf/cve-xccdf-update.sh: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/cve-xccdf/cve-xccdf-update.sh -------------------------------------------------------------------------------- /tools/cve-xccdf/oval-to-xccdf.xslt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/cve-xccdf/oval-to-xccdf.xslt -------------------------------------------------------------------------------- /tools/cve-xccdf/xccdf_1.1_to_1.2.xsl: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/cve-xccdf/xccdf_1.1_to_1.2.xsl -------------------------------------------------------------------------------- /tools/file-testing/file_test.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/file-testing/file_test.py -------------------------------------------------------------------------------- /tools/map-security-standard/map_standard.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/map-security-standard/map_standard.py -------------------------------------------------------------------------------- /tools/map-security-standard/map_standard_yaml.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/map-security-standard/map_standard_yaml.py -------------------------------------------------------------------------------- /tools/rules-testing/decoders/test_expr_negation_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/decoders/test_expr_negation_decoders.xml -------------------------------------------------------------------------------- /tools/rules-testing/decoders/test_osmatch_regex_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/decoders/test_osmatch_regex_decoders.xml -------------------------------------------------------------------------------- /tools/rules-testing/decoders/test_osregex_regex_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/decoders/test_osregex_regex_decoders.xml -------------------------------------------------------------------------------- /tools/rules-testing/decoders/test_pcre2_regex_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/decoders/test_pcre2_regex_decoders.xml -------------------------------------------------------------------------------- /tools/rules-testing/decoders/test_static_filters_decoders.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/decoders/test_static_filters_decoders.xml -------------------------------------------------------------------------------- /tools/rules-testing/rules/test_expr_negation_geoip_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/rules/test_expr_negation_geoip_rules.xml -------------------------------------------------------------------------------- /tools/rules-testing/rules/test_expr_negation_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/rules/test_expr_negation_rules.xml -------------------------------------------------------------------------------- /tools/rules-testing/rules/test_osmatch_regex_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/rules/test_osmatch_regex_rules.xml -------------------------------------------------------------------------------- /tools/rules-testing/rules/test_osregex_regex_geoip_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/rules/test_osregex_regex_geoip_rules.xml -------------------------------------------------------------------------------- /tools/rules-testing/rules/test_osregex_regex_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/rules/test_osregex_regex_rules.xml -------------------------------------------------------------------------------- /tools/rules-testing/rules/test_pcre2_regex_geoip_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/rules/test_pcre2_regex_geoip_rules.xml -------------------------------------------------------------------------------- /tools/rules-testing/rules/test_pcre2_regex_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/rules/test_pcre2_regex_rules.xml -------------------------------------------------------------------------------- /tools/rules-testing/rules/test_static_filters_rules.xml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/rules/test_static_filters_rules.xml -------------------------------------------------------------------------------- /tools/rules-testing/runtests.py: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/runtests.py -------------------------------------------------------------------------------- /tools/rules-testing/tests/SonicWall.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/SonicWall.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/apache.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/apache.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/apparmor.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/apparmor.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/checkpoint_smart1.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/checkpoint_smart1.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/cimserver.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/cimserver.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/cisco_asa.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/cisco_asa.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/cisco_ios.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/cisco_ios.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/cpanel.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/cpanel.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/doas.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/doas.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/dovecot.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/dovecot.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/exim.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/exim.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/firewalld.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/firewalld.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/junos.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/junos.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/macos-sshd.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/macos-sshd.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/mailscanner.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/mailscanner.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/mcafee_epo.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/mcafee_epo.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/modsecurity.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/modsecurity.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/named.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/named.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/netscreen.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/netscreen.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/nextcloud.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/nextcloud.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/nginx.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/nginx.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/opensmtpd.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/opensmtpd.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/openvpn_ldap.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/openvpn_ldap.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/oscap.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/oscap.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/ossec.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/ossec.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/owlh.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/owlh.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/paloalto.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/paloalto.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/pam.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/pam.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/panda_paps.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/panda_paps.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/postfix.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/postfix.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/proftpd.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/proftpd.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/rsh.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/rsh.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/samba.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/samba.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/squid_rules.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/squid_rules.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/sshd.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/sshd.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/su.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/su.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/sudo.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/sudo.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/syslog.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/syslog.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/sysmon.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/sysmon.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/systemd.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/systemd.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/test_expr_negation.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/test_expr_negation.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/test_expr_negation_geoip.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/test_expr_negation_geoip.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/test_features.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/test_features.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/test_osmatch_regex.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/test_osmatch_regex.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/test_osregex_regex.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/test_osregex_regex.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/test_osregex_regex_geoip.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/test_osregex_regex_geoip.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/test_pcre2_regex.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/test_pcre2_regex.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/test_pcre2_regex_geoip.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/test_pcre2_regex_geoip.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/test_static_filters.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/test_static_filters.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/test_static_filters_geoip.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/test_static_filters_geoip.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/unbound.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/unbound.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/vsftpd.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/vsftpd.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/web_appsec.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/web_appsec.ini -------------------------------------------------------------------------------- /tools/rules-testing/tests/web_rules.ini: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/tools/rules-testing/tests/web_rules.ini -------------------------------------------------------------------------------- /update_ruleset: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wazuh/wazuh-ruleset/HEAD/update_ruleset --------------------------------------------------------------------------------