gensecaihq

Verify on-host effect of executed containment actions with the wazuh_check_* tools, record verified/failed/unknown, and recommend ...

Find related Wazuh activity around a case by time window and entity pivots, detect kill-chain progression and campaigns across hos...

Map incidents, control checks and SCA results to ISO 27001:2022, PCI DSS v4.0.1, NIST SP 800-53r5 and CIS Controls v8.1 and write ...

gensecaihq/wazuh-autopilot

gensecaihq/wazuh-autopilot

Extract and normalize IPs, hosts, users, processes, files, hashes and domains from Wazuh alert JSON with attacker/victim/observed ...

gensecaihq/wazuh-autopilot

gensecaihq/wazuh-autopilot

Build an ordered, evidence-linked incident timeline with first/last seen, dwell time and pivot points; use when a case spans multi...

Enrich indicators (IPs, domains, URLs, hashes) with reputation and context, grade source reliability with the Admiralty Code, and ...

Incident-response playbook for ransomware — mass file modification/encryption, ransom notes, shadow-copy and backup deletion, serv...

Incident-response playbook (PB-005) for vulnerability spikes — sudden jumps in new CVE findings, the same CVE across many hosts, K...

Build a proportionate, ordered containment/eradication/recovery plan with risk scores and submit each action via propose_action fo...

Calculate and interpret SOC performance metrics — MTTD, MTTA, MTTR, MTTC, alert-to-incident ratio, false-positive and automation r...

Route SOC work across the agent swarm — decide which specialist handles a case next, write a complete handoff message, and stop cl...

Assess possible threat-actor or campaign links using the Diamond Model and ATT&CK group data, expressed with calibrated estimative...

How Wazuh active response actually works — commands, agent-side scripts, dispatch vs execution, permanence, blast radius, pre-chec...

Interpret Wazuh malware signals — rootcheck, VirusTotal and ClamAV integrations, Microsoft Antimalware events, Sysmon detections a...

How to query Wazuh through the Wazuh MCP Server efficiently and correctly — which tool answers which question, parameter syntax an...

Keep the Wazuh platform trustworthy — agent connectivity and version drift, manager and cluster health, event queue flooding and d...

Use Wazuh Security Configuration Assessment (SCA) results — CIS policy scores, failed checks and regressions — to prioritize harde...

gensecaihq/wazuh-autopilot