Default active response scripts
Wazuh agents ship with active response scripts for Linux, Unix, macOS, and Windows endpoints.
In Wazuh 5.x, Wazuh consolidates the firewall-specific active response scripts used in Wazuh 4.x into a single block-ip executable for each supported platform.
The block-ip executable attempts to use the available firewall mechanisms in a predefined order. If a firewall method is unavailable or unsupported on the endpoint, the executable automatically proceeds to the next available method. This approach removes the need to select or configure a firewall-specific script for each endpoint.
Linux and Unix-based endpoints
The table below lists out-of-the-box active response scripts for:
Linux/Unix endpoints, located in the Wazuh agent
/var/ossec/active-response/bindirectory.
Name of script |
Description |
|---|---|
Blocks or unblocks an IP address. The order depends on the platform. On Linux: |
|
Disables or re-enables a user account, using |
macOS endpoints
The table below lists out-of-the-box active response scripts for:
macOS endpoints, located in the Wazuh agent
/Library/Ossec/active-response/bindirectory.
Name of script |
Description |
|---|---|
Blocks or unblocks an IP address. On macOS, it tries pf and then |
Windows endpoints
The table below lists out-of-the-box scripts for Windows endpoints, located in the Wazuh agent C:\Program Files (x86)\ossec-agent\active-response\bin directory.
Name of script |
Description |
|---|---|
Blocks or unblocks an IP address. It tries |