Curated list of Wazuh resources, tools, and integrations
Wazuh is a free, open-source security monitoring platform for threat prevention, detection, and response.
- Official Documentation
- Getting Started
- Deployment
- Rules & Detection
- Integrations
- Tools & Utilities
- Compliance
- Training & Certification
- Guides & Tutorials
- Ambassador Program
- Community
- Contributing
- 🟢 Wazuh Documentation - Installation, configuration, and usage guides
- 🟢 Architecture Overview - System design and components
- 🟢 API Reference - REST API endpoints
- 🟢 Wazuh Blog - Weekly technical articles
- 🟢 Release Notes - Version history and changelog
- 🟢 Installation Guide - Step-by-step deployment instructions
- 🟢 Quickstart - Get running in 30-60 minutes
- 🟢 Wazuh Cloud - Fully managed SaaS option with free tier
- 🟢 Docker Quick Start - Single command deployment for testing
- 🟢 Official Docker Guide - Container deployment documentation
- 🟢 Docker Repository - Docker Compose files and images (1,000+ stars)
- 🟢 Official Kubernetes Guide - K8s cluster deployment
- 🟢 Helm Charts - Production-grade Helm packages with HA support
- 🟡 Terraform/OpenTofu Provider - Community provider, actively maintained
- 🟡 Terraform Registry - Official Terraform registry entry
- 🟢 Feature Request - Official Wazuh provider (planned)
- 🟢 Official Ansible Guide - Multi-host deployment automation
- 🟢 Ansible Playbooks - Ready-to-use playbooks (use release branches for production)
- 🟢 AWS Deployment - CloudTrail, GuardDuty, Security Hub, Macie
- 🟢 Azure Deployment - Log Analytics, Microsoft Graph, Intune
- 🟢 GCP Deployment - Pub/Sub and Cloud Storage integration
- 🟢 Virtual Machines (OVA/AMI) - Pre-built images for quick POC
- 🟢 Wazuh QA - Automated testing and CI/CD infrastructure
- 🟢 Rules Documentation - Rule syntax and optimization
- 🟢 Custom Rules Guide - Writing and testing custom rules
- 🟢 Official Ruleset - Complete rule repository
- 🟡 socfortress/Wazuh-Rules - Community rule collection
- 🟡 Ghost47-coder/Wazuh-Rules - Custom rule set and decoders
- 🟡 Fortigate Rules & Decoders - Fortigate device monitoring
- 🟡 Unifi Decoder - Ubiquiti Unifi network monitoring
Monitor Synology DSM systems for security events, file integrity, and access logs.
- 🟡 st0rm-cr0w Synology Rules - DSM decoder and rules
- 🟡 Tomo-9925 Synology Rules - Alternative DSM decoder implementation
- 🟢 File Integrity Monitoring (FIM) - Detect unauthorized file changes
- 🟢 Vulnerability Detection - CVE scanning and assessment
- 🟢 Configuration Assessment (SCA) - Compliance validation and hardening
- 🟢 Malware Detection - ClamAV and YARA integration
- 🟢 Active Response - Automated threat response
Connect Wazuh with external platforms for alerting, ticketing, threat intelligence, and orchestration.
- 🟢 Slack - Real-time alerts to Slack channels
- 🟢 PagerDuty - On-call incident escalation
- 🟢 Email - SMTP alert delivery
- 🟢 Generic API Integration - Trigger any external API
- 🟢 ServiceNow Integration - REST API + Python script
- 🟡 Jira Integration - Community guide
- 🟢 VirusTotal - File hash and URL enrichment
- 🟢 CDB Lists - Custom threat intelligence lists
- 🟢 AWS Security Hub - CloudTrail, GuardDuty, and Security Lake integration
- 🟢 Azure Sentinel - Microsoft Sentinel integration
- 🟢 Google Cloud - Cloud Audit Logs integration
- 🟡 Shuffle SOAR - Open-source SOAR with Wazuh support
- 🟢 Shuffle + Teams Integration - SOAR-based Teams alerting
- 🟡 Automated Threat Detection & Response (Medium) - Real-world Wazuh + Shuffle threat response automation
- 🟡 wazuh2thehive - TheHive case management integration
- 🟡 wazuh-opencti - OpenCTI threat intelligence platform
- 🟡 wazuh-integrations - Collection of custom integrations
- 🟡 Prometheus Exporter - Prometheus metrics and monitoring
- 🟡 Telegram Alerting - Telegram notification script
- 🟡 Custom Telegram - Advanced Telegram alert formatting
- 🟡 wazuh-nmap - Nmap network scan integration
- 🟡 Wazuh Tools - Collection of operational utility scripts
- 🟡 MCP Server Wazuh - Model Context Protocol server for Wazuh
- 🟡 Wazuh MCP Server - Alternative MCP implementation
Map Wazuh capabilities to regulatory frameworks.
- 🟢 PCI-DSS - Payment Card Industry Data Security Standard
- 🟢 GDPR - EU data protection regulation
- 🟢 NIS-2 - EU critical infrastructure directive (audit deadline June 30, 2026)
- 🟢 ISO 27001 - Information security management standard
- 🟢 HIPAA - Healthcare data protection
- 🟢 NIST 800-53 - Federal security controls
- 🟢 TSC (SOC 2) - Trust Service Criteria
- 🟢 Official Training Courses - 4-day authorized certification program
- 🟡 YouTube Tutorials - Official video guides
- 🟡 Udemy - Complete Wazuh Course - Beginner to advanced
- 🟡 initMAX - Wazuh Training - Certified Wazuh Professional credential
- 🟡 SIEM Intelligence - Certified Wazuh Administrator - CWA credential
Community-contributed guides for specific use cases and advanced configurations.
- 🟡 Wazuh Complete Guide - Comprehensive Wazuh setup and configuration guide
- 🟡 SOAR Flow Guide - SOAR orchestration and automation patterns
- 🟡 Bruteforce Detection Guide - Detecting and responding to brute force attacks
Represent Wazuh in your region. Become an ambassador and share your expertise.
- 🟢 Wazuh Ambassador Program - How to become an ambassador
- Ambassador Activities Guide - Content creation, speaking, training, partnerships
- 🟢 Wazuh Community - Slack workspace and forums
- 🟢 GitHub Discussions - Q&A and feature requests
- 🟢 GitHub Organization - 31+ repositories (14,600+ stars on main)
- 🟢 Professional Support - SLA-backed support services
This repository includes deployment templates and examples:
- Docker Compose (examples/docker-compose/) - Single and multi-node setups
- Terraform (examples/terraform/) - Infrastructure-as-code templates (OpenTofu compatible)
- Ansible (examples/ansible/) - Multi-host playbooks
- Vagrant (examples/vagrant/) - Local VM-based lab
Contributions welcome. To add a resource:
- Verify the link works (HTTP 200)
- Use appropriate badge: 🟢 Official (Wazuh project) | 🟡 Community
- Keep description to 1-2 lines, concrete and useful
- Add in correct category and alphabetical order
- Submit pull request
See CONTRIBUTING.md for guidelines.
Curated by: Franco Tampieri (TTlab® - Security & DevOps) | franco.tampieri@ttlab.it
Badges: 🟢 = Official (Wazuh) | 🟡 = Community