Elastic endpoint agent for malware detection

[Geoff Nordli]

Hi.

It seems the new Elastic endpoint management has some good protection
features.

https://www.elastic.co/endpoint-security/

At some point will Wazuh be able to leverage that technology?

thanks,

Geoff

[Yana Zaeva]

Hi Geoff,

First of all, my apologies for the late response. Regarding your question, you can approach something similar to that technology using the Active response module, for which I will leave the information here: https://documentation.wazuh.com/3.13/user-manual/capabilities/active-response/how-it-works.html

You can use it alongside the several anomaly detection modules we have enabled, as rootcheck and syscheck. You can check this link for further information about it: https://documentation.wazuh.com/3.13/user-manual/capabilities/anomalies-detection/index.html

Lastly, in this file, you will be able to find information about what's on the road for following Wazuh versions: https://github.com/wazuh/wazuh/blob/master/CHANGELOG.md#v400--

Hope I was helpful. Let me know if you have any doubts.

Regards,

Yana.