This is the documentation for Wazuh 2.1. Check out the docs for the latest version of Wazuh!
Edit on GitHub

FAQ

  1. Can I use a custom script for active response?
  2. Can I configure active response for only one host?
  3. Can active response remove the action after a time?

Can I use a custom script for active response?

Yes. You can create your own script and configure a command and active response to refer to it.

Can I configure active response for only one host?

Yes, using the location option. More info: Active Response options

Can active response remove the action after a time?

Yes, using the timeout_allowed option on the command and the timeout option on the active response. More info: Example