์—…๋ฐ์ดํŠธ๋กœ ๋Œ์•„๊ฐ€๊ธฐ
UpdatedJul 25, 2026

awesome-wazuh โ€” Updated!

๐Ÿ›ก๏ธWazuh XDR/SIEM์˜ ๋ชจ๋“  ํฅ๋ฏธ๋กœ์šด ์ฃผ์ œ์— ๊ด€ํ•œ ๋ฉ‹์ง„ ๋ฆฌ์ŠคํŠธ

๊ณต์œ 

awesome-wazuh Awesome

Wazuh ๋ฆฌ์†Œ์Šค, ๋„๊ตฌ ๋ฐ ํ†ตํ•ฉ์— ๋Œ€ํ•œ ์„ ๋ณ„๋œ ๋ชฉ๋ก

Wazuh๋Š” ์œ„ํ˜‘ ์˜ˆ๋ฐฉ, ํƒ์ง€ ๋ฐ ๋Œ€์‘์„ ์œ„ํ•œ ๋ฌด๋ฃŒ ์˜คํ”ˆ ์†Œ์Šค ๋ณด์•ˆ ๋ชจ๋‹ˆํ„ฐ๋ง ํ”Œ๋žซํผ์ž…๋‹ˆ๋‹ค.

๋ชฉ์ฐจ

๊ณต์‹ ๋ฌธ์„œ

์‹œ์ž‘ํ•˜๊ธฐ

์„ค์น˜ ๊ฐ€์ด๋“œ

Wazuh ์„ค์น˜, ๊ตฌ์„ฑ ๋ฐ ์šด์˜ ์ž‘์—…์„ ์œ„ํ•œ ๋‹จ๊ณ„๋ณ„ ์„ค์ • ์›Œํฌ์Šค๋ฃจ์ž…๋‹ˆ๋‹ค.

  • ๐ŸŸก samma-io/wazuh-help - Wazuh ๋ฐฐํฌ๋ฅผ ์œ„ํ•œ ์„ค์ • ๋„์›€๋ง, ๋ฌธ์ œ ํ•ด๊ฒฐ ๋ฐ ์šด์˜ ๋…ธํŠธ

๋ฐฐํฌ

Docker

Kubernetes

Terraform / OpenTofu

Ansible

ํด๋ผ์šฐ๋“œ ํ”Œ๋žซํผ

CI/CD ๋ฐ ํ…Œ์ŠคํŠธ

  • ๐ŸŸข Wazuh QA - ์ž๋™ํ™”๋œ ํ…Œ์ŠคํŠธ ๋ฐ CI/CD ์ธํ”„๋ผ

๊ทœ์น™ ๋ฐ ํƒ์ง€

์ปค๋ฎค๋‹ˆํ‹ฐ ๊ทœ์น™

์ผ๋ฐ˜ ๋ชฉ์ ์˜ ์ปค๋ฎค๋‹ˆํ‹ฐ ๊ทœ์น™ ๋ชจ์Œ์ž…๋‹ˆ๋‹ค.

  • ๐ŸŸก socfortress/Wazuh-Rules - ์ปค๋ฎค๋‹ˆํ‹ฐ ๊ทœ์น™ ๋ชจ์Œ
  • ๐ŸŸก Ghost47-coder/Wazuh-Rules - ์‚ฌ์šฉ์ž ์ •์˜ ๊ทœ์น™ ๋ฐ ๋””์ฝ”๋” ์„ธํŠธ

๋ฒค๋”๋ณ„ ๊ทœ์น™

ํŠน์ • ์žฅ์น˜, ์–ดํ”Œ๋ผ์ด์–ธ์Šค ๋ฐ ํ”Œ๋žซํผ์— ๋Œ€ํ•œ ๋””์ฝ”๋” ๋ฐ ๊ทœ์น™ ์„ธํŠธ์ž…๋‹ˆ๋‹ค.

ํƒ์ง€ ๋ชจ๋“ˆ

ํ†ตํ•ฉ

์•Œ๋ฆผ, ํ‹ฐ์ผ“ํŒ…, ์œ„ํ˜‘ ์ธํ…”๋ฆฌ์ „์Šค ๋ฐ ์˜ค์ผ€์ŠคํŠธ๋ ˆ์ด์…˜์„ ์œ„ํ•ด Wazuh๋ฅผ ์™ธ๋ถ€ ํ”Œ๋žซํผ๊ณผ ์—ฐ๊ฒฐํ•ฉ๋‹ˆ๋‹ค.

์•Œ๋ฆผ

  • ๐ŸŸข Slack - Slack ์ฑ„๋„๋กœ ์‹ค์‹œ๊ฐ„ ์•Œ๋ฆผ
  • ๐ŸŸข PagerDuty - ์˜จ์ฝœ ์‚ฌ๊ณ  ์—์Šค์ปฌ๋ ˆ์ด์…˜
  • ๐ŸŸข ์ด๋ฉ”์ผ - SMTP ์•Œ๋ฆผ ์ „์†ก

ํ‹ฐ์ผ“ํŒ…

์œ„ํ˜‘ ์ธํ…”๋ฆฌ์ „์Šค

  • ๐ŸŸข VirusTotal - ํŒŒ์ผ ํ•ด์‹œ ๋ฐ URL ๋ณด๊ฐ•
  • ๐ŸŸข CDB ๋ชฉ๋ก - ์‚ฌ์šฉ์ž ์ •์˜ ์œ„ํ˜‘ ์ธํ…”๋ฆฌ์ „์Šค ๋ชฉ๋ก

ํด๋ผ์šฐ๋“œ ํ”Œ๋žซํผ

  • ๐ŸŸข AWS Security Hub - CloudTrail, GuardDuty ๋ฐ Security Lake ํ†ตํ•ฉ
  • ๐ŸŸข Azure Sentinel - Microsoft Sentinel ํ†ตํ•ฉ
  • ๐ŸŸข Google Cloud - Cloud Audit Logs ํ†ตํ•ฉ

SOAR

์‚ฌ์šฉ์ž ์ •์˜ ํ†ตํ•ฉ

  • ๐ŸŸก wazuh2thehive - TheHive ์‚ฌ๋ก€ ๊ด€๋ฆฌ ํ†ตํ•ฉ
  • ๐ŸŸก wazuh-opencti - OpenCTI ์œ„ํ˜‘ ์ธํ…”๋ฆฌ์ „์Šค ํ”Œ๋žซํผ
  • ๐ŸŸก wazuh-integrations - ์‚ฌ์šฉ์ž ์ •์˜ ํ†ตํ•ฉ ๋ชจ์Œ
  • ๐ŸŸก Prometheus Exporter - Prometheus ๋ฉ”ํŠธ๋ฆญ ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง
  • ๐ŸŸก Sophos-Wazuh-SOC - SOC ์šด์˜์„ ์œ„ํ•œ Sophos ๋ฐฉํ™”๋ฒฝ ๋ฐ ์—”๋“œํฌ์ธํŠธ ํ†ตํ•ฉ
  • ๐ŸŸก Telegram ์•Œ๋ฆผ - Telegram ์•Œ๋ฆผ ์Šคํฌ๋ฆฝํŠธ
  • ๐ŸŸก ์‚ฌ์šฉ์ž ์ •์˜ Telegram - ๊ณ ๊ธ‰ Telegram ์•Œ๋ฆผ ์„œ์‹
  • ๐ŸŸก wazuh-nmap - Nmap ๋„คํŠธ์›Œํฌ ์Šค์บ” ํ†ตํ•ฉ

์œ ์ง€๋ณด์ˆ˜

๋ฐฑ์—… ๋ฐ ๋ณต์›

์•Œ๋ ค์ง„ ๋ฌธ์ œ

Debian/Ubuntu์—์„œ ์žฌ๋ถ€ํŒ… ํ›„ Wazuh ์„œ๋น„์Šค ์‹œ์ž‘ ์‹คํŒจ

์˜ฌ์ธ์› ์„ค์น˜์—์„œ ์ž˜ ์•Œ๋ ค์ง„ ๋ฌธ์ œ์ž…๋‹ˆ๋‹ค. Wazuh ์„œ๋น„์Šค(wazuh-indexer, wazuh-manager, wazuh-dashboard)์˜ systemd ์œ ๋‹›์— After= ์ข…์†์„ฑ์ด ์—†์–ด ๋ถ€ํŒ… ์‹œ ๊ฒฝํ•ฉ ์กฐ๊ฑด์ด ๋ฐœ์ƒํ•ฉ๋‹ˆ๋‹ค. ์ฆ์ƒ: ๋Œ€์‹œ๋ณด๋“œ๊ฐ€ "server is not ready yet" ๋ฐ˜ํ™˜, ์ธ๋ฑ์„œ๊ฐ€ failed ์ƒํƒœ๋กœ ์ „ํ™˜, ๋˜๋Š” PID ํŒŒ์ผ ๋ˆ„๋ฝ์œผ๋กœ ๋งค๋‹ˆ์ € ์‹คํŒจ.

  • ๐ŸŸก wazuh-indexer #201 - ์žฌ๋ถ€ํŒ… ํ›„ ์ธ๋ฑ์„œ ์‹คํŒจ: /var/log/wazuh-indexer/gc.log ๋””๋ ‰ํ† ๋ฆฌ ๋ˆ„๋ฝ
  • ๐ŸŸก wazuh-packages #1962 - ์žฌ๋ถ€ํŒ… ์‹œ ์ธ๋ฑ์„œ๊ฐ€ failed ์ƒํƒœ๋กœ ์ „ํ™˜ (v4.4.0+)
  • ๐ŸŸก wazuh/wazuh #31037 - JVM ์‹œ์ž‘ ์‹œ GC ๋กœ๊ทธ์— ๋Œ€ํ•œ Permission denied

ํ•ด๊ฒฐ ๋ฐฉ๋ฒ•: systemd ์˜ค๋ฒ„๋ผ์ด๋“œ๋ฅผ ์ƒ์„ฑํ•˜์—ฌ ์‹œ์ž‘ ์ˆœ์„œ๋ฅผ ๊ฐ•์ œํ•ฉ๋‹ˆ๋‹ค.

# /etc/systemd/system/wazuh-manager.service.d/override.conf
[Unit]
After=wazuh-indexer.service network-online.target

# /etc/systemd/system/wazuh-dashboard.service.d/override.conf
[Unit]
After=wazuh-indexer.service network-online.target

๊ทธ๋Ÿฐ ๋‹ค์Œ ๋‹ค์‹œ ๋กœ๋“œ: systemctl daemon-reload. ์ธ๋ฑ์„œ๊ฐ€ ์ดˆ๊ธฐํ™”์— ์ถ”๊ฐ€ ์‹œ๊ฐ„์ด ํ•„์š”ํ•œ ๊ฒฝ์šฐ ๋Œ€์‹œ๋ณด๋“œ ์˜ค๋ฒ„๋ผ์ด๋“œ์— ExecStartPre=/bin/sleep 15๋ฅผ ์ถ”๊ฐ€ํ•ฉ๋‹ˆ๋‹ค.

๋„๊ตฌ ๋ฐ ์œ ํ‹ธ๋ฆฌํ‹ฐ

  • ๐ŸŸก Wazuh ๋„๊ตฌ - ์šด์˜ ์œ ํ‹ธ๋ฆฌํ‹ฐ ์Šคํฌ๋ฆฝํŠธ ๋ชจ์Œ
  • ๐ŸŸก Wazuh ์ž๋™ ์ƒ์„ฑ๊ธฐ - ๊ฒฐ์ •์  ํŒจํ„ด ๋ถ„์„์„ ์‚ฌ์šฉํ•˜์—ฌ ์›์‹œ ๋กœ๊ทธ ์ƒ˜ํ”Œ์—์„œ ๋””์ฝ”๋” ๋ฐ ๊ทœ์น™ ์ƒ์„ฑ, ๋Œ€๋Ÿ‰ ๋กœ๊ทธ ๋ถ„์„ ๋ฐ ์•ฑ ๋‚ด ํ•„๋“œ ์ถ”์ถœ ์‹œ๋ฎฌ๋ ˆ์ด์…˜ ์ง€์›
  • ๐ŸŸก MCP Server Wazuh - Wazuh์šฉ Model Context Protocol ์„œ๋ฒ„
  • ๐ŸŸก Wazuh MCP Server - ๋Œ€์ฒด MCP ๊ตฌํ˜„

๊ทœ์ • ์ค€์ˆ˜

Wazuh ๊ธฐ๋Šฅ์„ ๊ทœ์ œ ํ”„๋ ˆ์ž„์›Œํฌ์— ๋งคํ•‘ํ•ฉ๋‹ˆ๋‹ค.

  • ๐ŸŸข PCI-DSS - ๊ฒฐ์ œ ์นด๋“œ ์‚ฐ์—… ๋ฐ์ดํ„ฐ ๋ณด์•ˆ ํ‘œ์ค€
  • ๐ŸŸข GDPR - EU ๋ฐ์ดํ„ฐ ๋ณดํ˜ธ ๊ทœ์ •
  • ๐ŸŸข NIS-2 - EU ์ค‘์š” ์ธํ”„๋ผ ์ง€์นจ (๊ฐ์‚ฌ ๋งˆ๊ฐ์ผ 2026๋…„ 6์›” 30์ผ)
  • ๐ŸŸข ISO 27001 - ์ •๋ณด ๋ณด์•ˆ ๊ด€๋ฆฌ ํ‘œ์ค€
  • ๐ŸŸข HIPAA - ์˜๋ฃŒ ๋ฐ์ดํ„ฐ ๋ณดํ˜ธ
  • ๐ŸŸข NIST 800-53 - ์—ฐ๋ฐฉ ๋ณด์•ˆ ํ†ต์ œ
  • ๐ŸŸข TSC (SOC 2) - ์‹ ๋ขฐ ์„œ๋น„์Šค ๊ธฐ์ค€

๊ต์œก ๋ฐ ์ธ์ฆ

๊ฐ€์ด๋“œ ๋ฐ ํŠœํ† ๋ฆฌ์–ผ

ํŠน์ • ์‚ฌ์šฉ ์‚ฌ๋ก€ ๋ฐ ๊ณ ๊ธ‰ ๊ตฌ์„ฑ์„ ์œ„ํ•œ ์ปค๋ฎค๋‹ˆํ‹ฐ ๊ธฐ์—ฌ ๊ฐ€์ด๋“œ์ž…๋‹ˆ๋‹ค.

AI ๋ฐ LLM ํ†ตํ•ฉ

ํƒ์ง€ ๋ฐ ๋Œ€์‘

์ผ๋ฐ˜

์•ฐ๋ฐฐ์„œ๋” ํ”„๋กœ๊ทธ๋žจ

ํ•ด๋‹น ์ง€์—ญ์—์„œ Wazuh๋ฅผ ๋Œ€ํ‘œํ•˜์„ธ์š”. ์•ฐ๋ฐฐ์„œ๋”๊ฐ€ ๋˜์–ด ์ „๋ฌธ ์ง€์‹์„ ๊ณต์œ ํ•˜์„ธ์š”.

์ปค๋ฎค๋‹ˆํ‹ฐ

์˜ˆ์ œ

์ด ์ €์žฅ์†Œ์—๋Š” ๋ฐฐํฌ ํ…œํ”Œ๋ฆฟ ๋ฐ ์˜ˆ์ œ๊ฐ€ ํฌํ•จ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค:

  • Docker Compose (examples/docker-compose/) - ๋‹จ์ผ ๋ฐ ๋‹ค์ค‘ ๋…ธ๋“œ ์„ค์ •
  • Terraform (examples/terraform/) - Infrastructure-as-Code ํ…œํ”Œ๋ฆฟ (OpenTofu ํ˜ธํ™˜)
  • Ansible (examples/ansible/) - ๋‹ค์ค‘ ํ˜ธ์ŠคํŠธ ํ”Œ๋ ˆ์ด๋ถ
  • Vagrant (examples/vagrant/) - ๋กœ์ปฌ VM ๊ธฐ๋ฐ˜ ์‹ค์Šต ํ™˜๊ฒฝ

๊ธฐ์—ฌํ•˜๊ธฐ

๊ธฐ์—ฌ๋ฅผ ํ™˜์˜ํ•ฉ๋‹ˆ๋‹ค. ๋ฆฌ์†Œ์Šค๋ฅผ ์ถ”๊ฐ€ํ•˜๋ ค๋ฉด:

  1. ๋งํฌ๊ฐ€ ์ž‘๋™ํ•˜๋Š”์ง€ ํ™•์ธ (HTTP 200)
  2. ์ ์ ˆํ•œ ๋ฐฐ์ง€ ์‚ฌ์šฉ: ๐ŸŸข ๊ณต์‹ (Wazuh ํ”„๋กœ์ ํŠธ) | ๐ŸŸก ์ปค๋ฎค๋‹ˆํ‹ฐ
  3. ์„ค๋ช…์„ 1-2์ค„๋กœ ๊ฐ„๊ฒฐํ•˜๊ณ  ์œ ์šฉํ•˜๊ฒŒ ์œ ์ง€
  4. ์˜ฌ๋ฐ”๋ฅธ ์นดํ…Œ๊ณ ๋ฆฌ์— ์•ŒํŒŒ๋ฒณ ์ˆœ์„œ๋กœ ์ถ”๊ฐ€
  5. ํ’€ ๋ฆฌํ€˜์ŠคํŠธ ์ œ์ถœ

์ž์„ธํ•œ ๋‚ด์šฉ์€ CONTRIBUTING.md๋ฅผ ์ฐธ์กฐํ•˜์„ธ์š”.

์„ ๋ณ„์ž: Franco Tampieri (TTlabยฎ - Security & DevOps) | [email protected]

๋ผ์ด์„ ์Šค

MIT

๋ฐฐ์ง€: ๐ŸŸข = ๊ณต์‹ (Wazuh) | ๐ŸŸก = ์ปค๋ฎค๋‹ˆํ‹ฐ

๋” ์ฝ๊ธฐ

์นดํ…Œ๊ณ ๋ฆฌ

Vulnerability ScannersConfiguration AuditingMalware AnalysisCloud SecurityDevSecOpsThreat IntelligenceIntrusion DetectionLearning & EducationIncident ResponseCurated ResourcesLog Analysis