SYNOTI / Wazuh Threat Hunting
Wazuh Threat Hunting
Proactive hunting across Wazuh events · 1.2M IOC correlation.
Techniques Mapped
38
this month
Hits / 24h
842
events matched
Hunting Queries
24
scheduled
Confirmed Threats
61
validated
IOC Correlation
1.2M
indicators
Hunt Query
Results
| Time | Agent | Rule | Technique | Severity |
|---|---|---|---|---|
| 18:42:11 | www-03 | 86605 | T1190 | Critical |
| 18:40:44 | ws-05 | 5503 | T1014 | High |
| 18:38:07 | proxy-02 | 577 | T1110 | Medium |
| 18:33:40 | mail-01 | 87103 | T1021 | High |
Hunt Findings / 24h
Matches by Technique
Recent Activity
View allRansomware behavior blocked on mail-01 CRITICAL
Playbook PB-041 auto-contained host · Ryuk TTPs matched
SSH brute force from 203.0.113.42 HIGH
42 failed logins in 60s · source IP blocked
Threat hunt matched T1059.001 on www-02
PowerShell obfuscation · confidence 0.91
SCA scan completed on 128 hosts
98.2% compliance · 11 benchmarks passed
Firewall rule 'BLK-3321' propagated to 14 nodes
0.4s propagation · geo-blocked 12 CIDRs
Sandbox verdict — 'invoice_9921.exe' malicious
Heuristic score 96 · family 'Emotet'