Wazuh Active Response and AbuseIPDB - Dynamically Block Known Malicious IPs with Wazuh

Подписаться 18 тыс.

Просмотров 5 тыс.

50% 1

Join me as we integrate Wazuh's Active Response and AbuseIPDB. Block known malicious IPs with Wazuh and the AbuseIPDB API! Let's deploy a Host Intrusion Detection System and SIEM with free open source tools. Join me as we explore and learn together.
Buy Me A Coffee: www.buymeacoffee.com/opensecure
Previous Video: • Wazuh and AbuseIPDB - ...
Bash Script: raw.githubusercontent.com/Ope...
Security Operations Center as a Service: www.socfortress.co/
Win a $50 Gift Card: www.youtube.com/watch?v=mFzu6...
Your Own Server: bit.ly/3Eug9Wf
Discord Channel: / discord
Check us out: www.opensecure.co/
Interact with our demo: www.socfortress.co/demo_acces...
Hire us: www.opensecure.co/contact-us

Наука

Опубликовано:

15 фев 2022

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 9

@marciolima174 2 года назад

All your videos are great! I'm waiting for the next one, I would like you to do a talking about how I can manage the logs so as not to compromise the size of the disk.

@taylorwalton_socfortress 2 года назад

Check out one of my previous videos where we covered log rotation : ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-jvFUdtMqe8U.html

@dcj4332 3 месяца назад

wonderful video. i love the way you explain the actions you take.

@oscarmarte4850 2 года назад

I love it, it's going a little bit beyond detection with abuseipdb (previous video), including blocking. Good and detailed explanation. How about making an integration video with wazuh, some opensource antiransomware for windows (Yjesus/antiransomware on github, or any other), or also some opensource edr. I can also think of any opensource antiddos integration? I have seen almost all the videos of wazuh and I have assembled it in my house. Thanks for entertaining me on weekends!!!

@numanmaavia8575 2 года назад

Great video

@JonathanRoy93 Год назад

Why are my iptables not showing the IP addresses that have been added? Does this have any effect because my firewall is turned off? the activity in integration. log is running, but the event in Wazuh is not showing. Wazuh manager is installed on CentOS 7.