Summary

In this chapter, we learned about IR phases, Wazuh’s active response capability, and some important use cases. We learned how Wazuh’s active response module actively blocks unauthorized SSH and RDP access attempts. Additionally, we also learned about Wazuh’s capability to isolate infected Windows machines promptly upon detection of malware.

In the next chapter, we will learn how to conduct threat hunting using Wazuh modules. We will learn the importance of log data analysis in Wazuh for better threat investigation and hunting. We will also utilize the MITRE ATT&CK framework to streamline our threat-hunting process.