
awesome-wazuh â Updated!
ð¡ïžWazuh XDR/SIEMã®ããããè峿·±ããããã¯ã«é¢ããçŽ æŽããããªã¹ãé
awesome-wazuh 
Wazuhã®ãªãœãŒã¹ãããŒã«ãçµ±åã«é¢ããå³éžãªã¹ã
Wazuhã¯ãè åšã®é²æ¢ãæ€åºã察å¿ã®ããã®ããªãŒã§ãªãŒãã³ãœãŒã¹ã®ã»ãã¥ãªãã£ç£èŠãã©ãããã©ãŒã ã§ãã
ç®æ¬¡
- å ¬åŒããã¥ã¡ã³ã
- ã¯ããã«
- ã»ããã¢ããã¬ã€ã
- ãããã€ã¡ã³ã
- ã«ãŒã«ãšæ€åº
- çµ±å
- ããŒã«ãšãŠãŒãã£ãªãã£
- ã¡ã³ããã³ã¹
- ã³ã³ãã©ã€ã¢ã³ã¹
- ãã¬ãŒãã³ã°ãšèªå®
- ã¬ã€ããšãã¥ãŒããªã¢ã«
- ã¢ã³ããµããŒããã°ã©ã
- ã³ãã¥ããã£
- è²¢ç®
å ¬åŒããã¥ã¡ã³ã
- ð¢ Wazuh ããã¥ã¡ã³ã - ã€ã³ã¹ããŒã«ãèšå®ã䜿çšã¬ã€ã
- ð¢ ã¢ãŒããã¯ãã£æŠèŠ - ã·ã¹ãã èšèšãšã³ã³ããŒãã³ã
- ð¢ API ãªãã¡ã¬ã³ã¹ - REST API ãšã³ããã€ã³ã
- ð¢ Wazuh ããã° - æ¯é±ã®æè¡èšäº
- ð¢ ãªãªãŒã¹ããŒã - ããŒãžã§ã³å±¥æŽãšå€æŽãã°
ã¯ããã«
- ð¢ ã€ã³ã¹ããŒã«ã¬ã€ã - æé ããšã®ãããã€æé
- ð¢ ã¯ã€ãã¯ã¹ã¿ãŒã - 30ïœ60åã§çšŒåéå§
- ð¢ Wazuh Cloud - ç¡ææ ä»ããã«ãããŒãžã SaaS ãªãã·ã§ã³
- ð¢ Docker ã¯ã€ãã¯ã¹ã¿ãŒã - ãã¹ãçšã®åäžã³ãã³ããããã€
ã»ããã¢ããã¬ã€ã
Wazuhã®ã€ã³ã¹ããŒã«ãèšå®ãéçšã¿ã¹ã¯ã«é¢ããã¹ããããã€ã¹ãããã®ã»ããã¢ããæé ã
- ð¡ samma-io/wazuh-help - Wazuhãããã€ã¡ã³ãã®ã»ããã¢ãããã«ãããã©ãã«ã·ã¥ãŒãã£ã³ã°ãéçšããŒã
ãããã€ã¡ã³ã
Docker
- ð¢ å ¬åŒ Docker ã¬ã€ã - ã³ã³ãããããã€ã¡ã³ãããã¥ã¡ã³ã
- ð¢ Docker ãªããžã㪠- Docker Compose ãã¡ã€ã«ãšã€ã¡ãŒãžïŒ1000 以äžã®ã¹ã¿ãŒïŒ
Kubernetes
- ð¢ å ¬åŒ Kubernetes ã¬ã€ã - K8s ã¯ã©ã¹ã¿ãŒãããã€
- ð¢ Helm ãã£ãŒã - HA 察å¿ã®ãããã¯ã·ã§ã³ã°ã¬ãŒã Helm ããã±ãŒãž
Terraform / OpenTofu
- ð¡ Terraform/OpenTofu ãããã€ã㌠- ã³ãã¥ããã£ãããã€ããŒãç©æ¥µçã«ã¡ã³ããã³ã¹äž
- ð¡ Terraform ã¬ãžã¹ã㪠- å ¬åŒ Terraform ã¬ãžã¹ããªãšã³ããª
- ð¢ æ©èœãªã¯ãšã¹ã - å ¬åŒ Wazuh ãããã€ããŒïŒäºå®ïŒ
Ansible
- ð¢ å ¬åŒ Ansible ã¬ã€ã - ãã«ããã¹ããããã€èªåå
- ð¢ Ansible ãã¬ã€ãã㯠- ããã«äœ¿ãããã¬ã€ããã¯ïŒæ¬çªç°å¢ã§ã¯ãªãªãŒã¹ãã©ã³ãã䜿çšïŒ
ã¯ã©ãŠããã©ãããã©ãŒã
- ð¢ AWS ããã〠- CloudTrailãGuardDutyãSecurity HubãMacie
- ð¢ Azure ããã〠- Log AnalyticsãMicrosoft GraphãIntune
- ð¢ GCP ããã〠- Pub/Sub ãš Cloud Storage ã®çµ±å
- ð¢ ä»®æ³ãã·ã³ (OVA/AMI) - è¿ é㪠POC çšã®ãã«ãæžã¿ã€ã¡ãŒãž
CI/CD ãšãã¹ã
- ð¢ Wazuh QA - èªåãã¹ããš CI/CD ã€ã³ãã©ã¹ãã©ã¯ãã£
ã«ãŒã«ãšæ€åº
- ð¢ ã«ãŒã«ããã¥ã¡ã³ã - ã«ãŒã«æ§æãšæé©å
- ð¢ ã«ã¹ã¿ã ã«ãŒã«ã¬ã€ã - ã«ã¹ã¿ã ã«ãŒã«ã®äœæãšãã¹ã
- ð¢ å ¬åŒã«ãŒã«ã»ãã - å®å šãªã«ãŒã«ãªããžããª
ã³ãã¥ããã£ã«ãŒã«
æ±çšã®ã³ãã¥ããã£ã«ãŒã«ã³ã¬ã¯ã·ã§ã³ã
- ð¡ socfortress/Wazuh-Rules - ã³ãã¥ããã£ã«ãŒã«ã³ã¬ã¯ã·ã§ã³
- ð¡ Ghost47-coder/Wazuh-Rules - ã«ã¹ã¿ã ã«ãŒã«ã»ãããšãã³ãŒããŒ
ãã³ããŒåºæã«ãŒã«
ç¹å®ã®ããã€ã¹ãã¢ãã©ã€ã¢ã³ã¹ããã©ãããã©ãŒã åãã®ãã³ãŒããŒãšã«ãŒã«ã»ããã
- ð¡ Fortigate ã«ãŒã«ãšãã³ãŒã㌠- Fortigate ããã€ã¹ç£èŠ
- ð¡ Pi-hole ãã³ãŒããŒãšã«ãŒã« - Pi-hole DNS ã·ã³ã¯ããŒã«ç£èŠãšæ€åº
- ð¡ Synology DSM (st0rm-cr0w) - Synology DSM ãã³ãŒããŒãšã«ãŒã«
- ð¡ Synology DSM (Tomo-9925) - ä»£æ¿ Synology DSM ãã³ãŒããŒå®è£
- ð¡ Unifi ãã³ãŒã㌠- Ubiquiti Unifi ãããã¯ãŒã¯ç£èŠ
æ€åºã¢ãžã¥ãŒã«
- ð¢ ãã¡ã€ã«æŽåæ§ç£èŠ (FIM) - äžæ£ãªãã¡ã€ã«å€æŽãæ€åº
- ð¢ èåŒ±æ§æ€åº - CVE ã¹ãã£ã³ãšè©äŸ¡
- ð¢ èšå®è©äŸ¡ (SCA) - ã³ã³ãã©ã€ã¢ã³ã¹æ€èšŒãšåŒ·å
- ð¢ ãã«ãŠã§ã¢æ€åº - ClamAV ãš YARA ã®çµ±å
- ð¢ ã¢ã¯ãã£ãã¬ã¹ãã³ã¹ - èªååãããè åšå¯Ÿå¿
çµ±å
Wazuh ãå€éšãã©ãããã©ãŒã ãšæ¥ç¶ããŠãã¢ã©ãŒãéç¥ããã±ãã管çãè åšã€ã³ããªãžã§ã³ã¹ããªãŒã±ã¹ãã¬ãŒã·ã§ã³ãå®çŸããŸãã
ã¢ã©ãŒãéç¥
- ð¢ Slack - Slack ãã£ã³ãã«ãžã®ãªã¢ã«ã¿ã€ã ã¢ã©ãŒã
- ð¢ PagerDuty - ãªã³ã³ãŒã«ã€ã³ã·ãã³ããšã¹ã«ã¬ãŒã·ã§ã³
- ð¢ ã¡ãŒã« - SMTP ã¢ã©ãŒãé ä¿¡
ãã±ãã管ç
- ð¢ æ±çš API çµ±å - ä»»æã®å€éš API ãããªã¬ãŒ
- ð¢ ServiceNow çµ±å - REST API + Python ã¹ã¯ãªãã
- ð¡ Jira çµ±å - ã³ãã¥ããã£ã¬ã€ã
è åšã€ã³ããªãžã§ã³ã¹
- ð¢ VirusTotal - ãã¡ã€ã«ããã·ã¥ãšURLã®ãšã³ãªããã¡ã³ã
- ð¢ CDB ãªã¹ã - ã«ã¹ã¿ã è åšã€ã³ããªãžã§ã³ã¹ãªã¹ã
ã¯ã©ãŠããã©ãããã©ãŒã
- ð¢ AWS Security Hub - CloudTrailãGuardDutyãSecurity Lake çµ±å
- ð¢ Azure Sentinel - Microsoft Sentinel çµ±å
- ð¢ Google Cloud - Cloud Audit Logs çµ±å
SOAR
- ð¡ Shuffle SOAR - Wazuh 察å¿ã®ãªãŒãã³ãœãŒã¹ SOAR
- ð¢ Shuffle + Teams çµ±å - SOAR ããŒã¹ã® Teams ã¢ã©ãŒãéç¥
- ð¡ èªååãããè åšæ€åºãšå¯Ÿå¿ (Medium) - å®è·µç㪠Wazuh + Shuffle è åšå¯Ÿå¿èªåå
ã«ã¹ã¿ã çµ±å
- ð¡ wazuh2thehive - TheHive ã±ãŒã¹ç®¡ççµ±å
- ð¡ wazuh-opencti - OpenCTI è åšã€ã³ããªãžã§ã³ã¹ãã©ãããã©ãŒã
- ð¡ wazuh-integrations - ã«ã¹ã¿ã çµ±åã®ã³ã¬ã¯ã·ã§ã³
- ð¡ Prometheus Exporter - Prometheus ã¡ããªã¯ã¹ãšç£èŠ
- ð¡ Sophos-Wazuh-SOC - SOC éçšã®ããã® Sophos ãã¡ã€ã¢ãŠã©ãŒã«ããã³ãšã³ããã€ã³ãçµ±å
- ð¡ Telegram ã¢ã©ãŒãéç¥ - Telegram éç¥ã¹ã¯ãªãã
- ð¡ ã«ã¹ã¿ã Telegram - é«åºŠãª Telegram ã¢ã©ãŒããã©ãŒããã
- ð¡ wazuh-nmap - Nmap ãããã¯ãŒã¯ã¹ãã£ã³çµ±å
ã¡ã³ããã³ã¹
ããã¯ã¢ãããšåŸ©å
- ð¢ ããã¯ã¢ããã®äœæ â äžå€®ã³ã³ããŒãã³ã - å
¬åŒã¬ã€ã: ããã¯ã¢ãããããã£ã¬ã¯ã㪠(
/etc/wazuh-indexer/ã/var/ossec/etc/ãèšŒææž) ãrsync+tarã§ããã¯ã¢ãã - ð¢ äžå€®ã³ã³ããŒãã³ãã®åŸ©å - ã·ã³ã°ã«ããŒãããã³ãã«ãããŒãã¯ã©ã¹ã¿ãŒã®æ®µéçãªåŸ©å æé
- ð¢ ã€ã³ããã¯ã¹ããã¯ã¢ãã管ç - å ¬åŒããã°: ã¢ã©ãŒãããŒã¿ã® OpenSearch ã¹ãããã·ã§ãã â ãã¡ã€ã«ã·ã¹ãã ãS3ãAzureãGCSãSLM èªåå
- ð¡ ã¹ãããã·ã§ãããšåŸ©å
â å®è·µã¬ã€ã - ã³ãã¥ããã£ã®æé :
path.repoèšå®ãCLI ãš Dashboard UI ã«ããã¹ãããã·ã§ãããcron èªåå
æ¢ç¥ã®åé¡
Debian/Ubuntu ã§åèµ·ååŸã« Wazuh ãµãŒãã¹ãèµ·åããªã
ãªãŒã«ã€ã³ã¯ã³ã€ã³ã¹ããŒã«ã§ããç¥ãããåé¡ã§ããWazuh ãµãŒãã¹ (wazuh-indexerãwazuh-managerãwazuh-dashboard) ã® systemd ãŠãããã«ã¯ After= äŸåé¢ä¿ããªããèµ·åæã«ç«¶åç¶æ
ãçºçããŸããçç¶: ããã·ã¥ããŒãããserver is not ready yetããè¿ããã€ã³ãã¯ãµãŒã failed ç¶æ
ã«ãªãããŸãã¯ãããŒãžã£ãŒã PID ãã¡ã€ã«äžè¶³ã§å€±æããã
- ð¡ wazuh-indexer #201 - åèµ·ååŸã«ã€ã³ãã¯ãµãŒã倱æ:
/var/log/wazuh-indexer/gc.logãã£ã¬ã¯ããªããªã - ð¡ wazuh-packages #1962 - åèµ·ååŸã«ã€ã³ãã¯ãµãŒã
failedç¶æ ã«ãªã (v4.4.0+) - ð¡ wazuh/wazuh #31037 - JVM èµ·åæã« GC ãã°ã§
Permission deniedãçºç
åé¿ç: systemd ãªãŒããŒã©ã€ããäœæããŠèµ·åé åºã匷å¶ãã:
# /etc/systemd/system/wazuh-manager.service.d/override.conf
[Unit]
After=wazuh-indexer.service network-online.target
# /etc/systemd/system/wazuh-dashboard.service.d/override.conf
[Unit]
After=wazuh-indexer.service network-online.target
ãã®åŸããªããŒã: systemctl daemon-reloadãã€ã³ãã¯ãµãŒã®åæåã«ããã«æéãå¿
èŠãªå Žåã¯ãããã·ã¥ããŒããªãŒããŒã©ã€ãã« ExecStartPre=/bin/sleep 15 ã远å ããŸãã
ããŒã«ãšãŠãŒãã£ãªãã£
- ð¡ Wazuh Tools - éçšãŠãŒãã£ãªãã£ã¹ã¯ãªããã®ã³ã¬ã¯ã·ã§ã³
- ð¡ Wazuh Auto-Generator - 決å®è«çãã¿ãŒã³åæã䜿çšããŠçã®ãã°ãµã³ãã«ãããã³ãŒããŒãšã«ãŒã«ãçæãäžæ¬ãã°åæãšã¢ããªå ãã£ãŒã«ãæœåºã·ãã¥ã¬ãŒã·ã§ã³å¯Ÿå¿
- ð¡ MCP Server Wazuh - Wazuh çš Model Context Protocol ãµãŒããŒ
- ð¡ Wazuh MCP Server - ä»£æ¿ MCP å®è£
ã³ã³ãã©ã€ã¢ã³ã¹
Wazuh ã®æ©èœãèŠå¶ãã¬ãŒã ã¯ãŒã¯ã«ãããã³ã°ããŸãã
- ð¢ PCI-DSS - ãã€ã¡ã³ãã«ãŒãæ¥çããŒã¿ã»ãã¥ãªãã£åºæº
- ð¢ GDPR - EU ããŒã¿ä¿è·èŠå
- ð¢ NIS-2 - EU éèŠã€ã³ãã©æä»€ (ç£æ»æé: 2026幎6æ30æ¥)
- ð¢ ISO 27001 - æ å ±ã»ãã¥ãªãã£ç®¡çæšæº
- ð¢ HIPAA - å»çããŒã¿ä¿è·
- ð¢ NIST 800-53 - é£éŠã»ãã¥ãªãã£ç®¡çç
- ð¢ TSC (SOC 2) - Trust Service Criteria
ãã¬ãŒãã³ã°ãšèªå®
- ð¢ å ¬åŒãã¬ãŒãã³ã°ã³ãŒã¹ - 4æ¥éã®å ¬èªèªå®ããã°ã©ã
- ð¡ YouTube ãã¥ãŒããªã¢ã« - å ¬åŒãããªã¬ã€ã
- ð¡ Udemy - Complete Wazuh Course - åå¿è ããäžçŽè ãŸã§
- ð¡ initMAX - Wazuh Training - èªå® Wazuh Professional è³æ Œ
- ð¡ SIEM Intelligence - Certified Wazuh Administrator - CWA è³æ Œ
ã¬ã€ããšãã¥ãŒããªã¢ã«
ã³ãã¥ããã£æäŸã®ãç¹å®ã®ãŠãŒã¹ã±ãŒã¹ãé«åºŠãªèšå®ã«é¢ããã¬ã€ãã
AI ãš LLM çµ±å
- ð¡ Wazuh ããã·ã¥ããŒãå ã®ããŒã«ã« Ollama - Wazuh ããã·ã¥ããŒãã«åã蟌ãŸããããŒã«ã« Ollama ã€ã³ã¹ã¿ã³ã¹ã䜿çšãã LLM ããŒã¹ã®ã¢ã©ãŒãã€ã³ãµã€ã
- ð¡ Wazuh + AWS Bedrock + MCP (ããŒã 1) - AI é§åã®ã»ãã¥ãªãã£åæã®ããã® Wazuh ãš AWS Bedrock ããã³ Model Context Protocol ã®çµ±å
- ð¡ Wazuh + AWS Bedrock + MCP (ããŒã 2) - Wazuh + AWS Bedrock + MCP çµ±åã®é«åºŠãªèšå®ãšãŠãŒã¹ã±ãŒã¹
æ€åºãšå¯Ÿå¿
- ð¡ SOAR Flow ã¬ã€ã - SOAR ãªãŒã±ã¹ãã¬ãŒã·ã§ã³ãšèªååã®ãã¿ãŒã³
- ð¡ ãã«ãŒããã©ãŒã¹æ€åºã¬ã€ã - ãã«ãŒããã©ãŒã¹æ»æã®æ€åºãšå¯Ÿå¿
äžè¬
- ð¡ Wazuh Complete Guide - å æ¬ç㪠Wazuh ã»ããã¢ããããã³èšå®ã¬ã€ã
ã¢ã³ããµããŒããã°ã©ã
ããªãã®å°åã§ Wazuh ã代衚ããŸããããã¢ã³ããµããŒã«ãªã£ãŠå°éç¥èãå ±æããŠãã ããã
- ð¢ Wazuh ã¢ã³ããµããŒããã°ã©ã - ã¢ã³ããµããŒã«ãªãæ¹æ³
- ã¢ã³ããµããŒæŽ»åã¬ã€ã - ã³ã³ãã³ãäœæãè¬æŒããã¬ãŒãã³ã°ãããŒãããŒã·ãã
ã³ãã¥ããã£
- ð¢ Wazuh ã³ãã¥ãã㣠- Slack ã¯ãŒã¯ã¹ããŒã¹ãšãã©ãŒã©ã
- ð¢ GitHub Discussions - Q&A ãšæ©èœãªã¯ãšã¹ã
- ð¢ GitHub Organization - 31 以äžã®ãªããžã㪠(ã¡ã€ã³ãªããžããªã§ 14,600 以äžã®ã¹ã¿ãŒ)
- ð¢ ãããã§ãã·ã§ãã«ãµããŒã - SLA ä»ããµããŒããµãŒãã¹
äŸ
ãã®ãªããžããªã«ã¯ãããã€ã¡ã³ããã³ãã¬ãŒããšãµã³ãã«ãå«ãŸããŠããŸã:
- Docker Compose (examples/docker-compose/) - ã·ã³ã°ã«ããŒãããã³ãã«ãããŒãæ§æ
- Terraform (examples/terraform/) - Infrastructure-as-Code ãã³ãã¬ãŒã (OpenTofu äºæ)
- Ansible (examples/ansible/) - ãã«ããã¹ããã¬ã€ããã¯
- Vagrant (examples/vagrant/) - ããŒã«ã« VM ããŒã¹ã®ã©ã
è²¢ç®
è²¢ç®ã¯æè¿ããŸãããªãœãŒã¹ã远å ããã«ã¯:
- ãªã³ã¯ãåäœããããšã確èªããŠãã ãã (HTTP 200)
- é©åãªãããžã䜿çš: ð¢ å ¬åŒ (Wazuh ãããžã§ã¯ã) | ð¡ ã³ãã¥ããã£
- 説æã¯1ã2è¡ã«æããå ·äœçã§åœ¹ç«ã€ãã®ã«ããŠãã ãã
- é©åãªã«ããŽãªã«è¿œå ããã¢ã«ãã¡ãããé ã«äžŠã¹ãŠãã ãã
- ãã«ãªã¯ãšã¹ããéä¿¡ããŠãã ãã
ã¬ã€ãã©ã€ã³ã«ã€ããŠã¯ CONTRIBUTING.md ãåç §ããŠãã ããã
ãã¥ã¬ãŒã¿ãŒ: Franco Tampieri (TTlab® - Security & DevOps) | [email protected]
ã©ã€ã»ã³ã¹
ãããž: ð¢ = å ¬åŒ (Wazuh) | ð¡ = ã³ãã¥ããã£