SOC-Files

WAZUH

• /var/ossec/etc/
  • ossec.conf
• /etc/filebeat/
  • filebeat.conf
• /var/ossec/etc/rules/
  • Rules
• /etc/wazuh-indexer/
  • opensearch.yml
• /var/ossec/etc/decoders/
  • Decoders

Fluent-Bit

• fluent-bit.conf

Integrations

• /var/ossec/integrations
  • custom-abuseipdb
  • custom-abuseipdb.py
  • custom-alienvault
  • custom-alienvault.py
  • custom-shuffle
  • custom-shuffle.py
  • custom-urlhaus.py
  • custom-w2thive
  • custom-w2thive.py
  • virustotal
  • virustotal.py
  • wazuh-llm-enrichment.py
  • get_malicious.py

To run the powershell script:

powershell -NoProfile -ExecutionPolicy Bypass -Command "& {Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/effaaykhan/SOC-Files/main/cybersentinel-agent.ps1' -OutFile $env:TEMP\cybersentinel-agent.ps1; powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP\cybersentinel-agent.ps1}"