Active response

The Wazuh Active Response module automates incident response by executing predefined actions when events match specified rules in the Wazuh ruleset. These actions can block or drop network traffic, throttle connections, lock user accounts, or perform other user-defined response actions.

The Wazuh Active Response module helps to meet the following PCI DSS requirement:

• Requirement 11 - Test Security of Systems and Networks Regularly: Vulnerabilities are being discovered continually by malicious individuals and researchers, and being introduced by new software. System components, processes, and bespoke and custom software must be tested frequently to verify security controls continue to reflect a changing environment.

This requirement mandates regular testing of systems and networks to detect and respond to security issues and potential intrusions. With the Wazuh Active Response module, you can respond to intrusions and unauthorized file changes. More details on configuring the Wazuh Active Response module are available in the active response documentation section.

Use case

Below is a PCI DSS requirement that the Wazuh Active Response module can meet.

PCI DSS requirement 11.5

PCI DSS requirement 11.5 mandates that you detect and respond to network intrusions and unexpected file changes. You can configure scripts to run when specific actions occur, enabling a response to these intrusions. Wazuh comes with preconfigured active response scripts. Refer to the default active response scripts section to access these scripts.

In the example below, the Wazuh Active Response module automatically blocks a malicious IP address when it matches one in the reputation database. A blocked IP address prevents the attacker from accessing web resources on the monitored Apache web server. See Blocking a known malicious actor for more information.