IOCs based Rules

[John Carry]

Dear Wazuh Team,
Please provide us way to create IOCs based rules, for example what if we want to trigger rule for Hashes, IPs, File Names etc.

[Pacome Kemkeu]

Hello John, 

The following blog post have all the coverage for your request, kindly take a look:

• URLHaus: Detecting malicious URLs using Wazuh and URLhaus
• ABuseIPDB: Detecting known bad actors with Wazuh and AbuseIPDB
  Building IoCs files for Threat Intel: build your own IoC files for threat intelligence with Wazuh XDR 
  

• VirusTotal: Detecting and removing malware using VirusTotal integration

I hope you find this helpful.