Command monitoring

The Wazuh command monitoring capability runs commands or binaries on monitored endpoints at specified intervals and forwards their output to Wazuh for analysis.

Depending on your needs, you can use the Wazuh Command module to run desired or custom commands that perform the following:

• Checks that a critical service or process is running

• Monitors disk space, memory, or CPU usage thresholds

• Runs custom security or compliance checks (e.g., verifying a configuration setting)

• Detects the presence or absence of specific files, users, or packages

• Integrates third-party scripts or health-check tools in Wazuh

• Periodically checks network connectivity or port-reachability

Although some of the activities above can be performed using the SCA and Syscollector modules, the Command module allows you to run the checks at a more fine-tuned interval and produces outputs you can decode and trigger findings for.