Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ Your input is essential to the continuous improvement of LME and to ensure it be
1. [Retrieving Passwords](#retrieving-passwords)
2. [Starting and Stopping LME](#starting-and-stopping-lme)
3. [Uninstall LME](#uninstall-lme)
5. [Documentation:](#5-documentation)
5. [Documentation](#5-documentation)
6. [Developer Notes](#6-developer-notes)


Expand Down Expand Up @@ -263,7 +263,7 @@ ok: [localhost] => {
### 5. Deploying Agents
To populate the dashboards with data, you need to install agents. Detailed guides for deploying Wazuh and Elastic agents are available in the following documents:

- [Deploy Wazuh Agent](/docs/markdown/agents/wazuh-agent-mangement.md)
- [Deploy Wazuh Agent](/docs/markdown/agents/wazuh-agent-management.md)
- [Deploying Elastic-Agent](/docs/markdown/agents/elastic-agent-management.md)


Expand Down Expand Up @@ -380,9 +380,9 @@ We're doing our best to have regular updates that add new and/or requested featu
1. [Alerting](/docs/markdown/maintenance/elastalert-rules.md): Adding custom notifications for triggered alerts using elastalert2
2. [Active Response](/docs/markdown/agents/wazuh-active-response.md): Creating custom wazuh active response actions to automatically respond to a malicious event wazuh detects.
3. [Backups](/docs/markdown/maintenance/backups.md): Customizing backups of logs for your organizations own compliance needs.
4. [Custom log types](/docs/markdown/agents/elastic-agent-mangement.md#lme-elastic-agent-integration-example): using elastic agents built in [integrations](https://www.elastic.co/guide/en/integrations/current/index.html) ingest a log type specific to your organization.
4. [Custom log types](/docs/markdown/agents/elastic-agent-management.md#lme-elastic-agent-integration-example): using elastic agents built in [integrations](https://www.elastic.co/guide/en/integrations/current/index.html) ingest a log type specific to your organization.

## 5. Documentation:
## 5. Documentation

### Logging Guidance
- [LME in the Cloud](/docs/markdown/logging-guidance/cloud.md)
Expand Down Expand Up @@ -412,11 +412,11 @@ We're doing our best to have regular updates that add new and/or requested featu

### Agents:
Here is documentation on agent configuration and management.
- [Elastic-Agent](/docs/markdown/agents/elastic-agent-mangement.md)
- [Elastic-Agent](/docs/markdown/agents/elastic-agent-management.md)
- Wazuh:
- [Wazuh Configuration](/docs/markdown/maintenance/wazuh-configuration.md)
- [Active Response](/docs/markdown/agents/wazuh-active-response.md)
- [Agent Management](/docs/markdown/agents/wazuh-agent-mangement.md)
- [Agent Management](/docs/markdown/agents/wazuh-agent-management.md)

### Endpoint Tools:
To make best use of the agents, complement them with utilities that generate forensically relevant data to analyze and support detections.
Expand All @@ -427,7 +427,7 @@ Consider adding them to Windows/Linux.
#### Linux:
- [Auditd](/docs/markdown/endpoint-tools/install-auditd.md)

## 6. Developer notes:
## 6. Developer Notes
Git clone and git checkout your development branch on the server:

```bash
Expand Down
4 changes: 2 additions & 2 deletions build/includes.txt
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ Readme.md
./docs/markdown/maintenance/volume-management.md
./docs/markdown/maintenance/vulnerability-scan-setup.md
./docs/markdown/maintenance/wazuh-configuration.md
./docs/markdown/agents/elastic-agent-mangement.md
./docs/markdown/agents/elastic-agent-management.md
./docs/markdown/agents/wazuh-active-response.md
./docs/markdown/agents/wazuh-agent-mangement.md
./docs/markdown/agents/wazuh-agent-management.md
./docs/markdown/endpoint-tools/install-auditd.md
./docs/markdown/endpoint-tools/install-sysmon.md
4 changes: 2 additions & 2 deletions docs/markdown/agents/wazuh-active-response.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ Wazuh can automatically block IP addresses attempting SSH brute-force attacks us
1. **Verify Default Script**:
- Check for `firewall-drop` script in `/var/ossec/active-response/bin/` on Linux/Unix systems.

2. **Configure Command in wazuh_manager.conf**: Note this command (firewall-drop) already exists. But you can create custom scripts located in the active response/bin path and add new commands into the .conf file located at wazuh_manger.conf located at /opt/lme/config/wazuh_cluster/wazuh_manager.conf
2. **Configure Command in wazuh_manager.conf**: Note this command (firewall-drop) already exists. But you can create custom scripts located in the active response/bin path and add new commands into the .conf file located at wazuh_manager.conf located at /opt/lme/config/wazuh_cluster/wazuh_manager.conf



Expand Down Expand Up @@ -64,4 +64,4 @@ This setup provides an automated defense against SSH brute-force attacks, enhanc

See a list of Wazuh Rules that trigger here: [Wazuh Ruleset](https://github.com/wazuh/wazuh/tree/master/ruleset/rules)

Consult Wazuh Documentation for more on active response configuration.
Consult Wazuh Documentation for more on active response configuration.
Loading