Attention This documentation covers an upcoming release that is still under development. For the current stable documentation, check out the latest version.

Use cases

The use cases described below are performed on an Ubuntu 24.04 endpoint that has a Wazuh agent installed and enrolled in a Wazuh manager. The first four use cases do not need custom rules; the Linux kernel emits the ANOM_ABEND, ANOM_PROMISCUOUS, DAEMON_END, and DAEMON_START records they rely on automatically.

Detect when the Audit daemon stops
Detect when the Audit daemon starts
Detect abnormal process termination
Detect a network interface entering promiscuous mode