Browse categories
Explore
Fiverr Pro
English
$
USD
I will build automated incident response and active response rules with wazuh
Cyber Security Analyst, Wazuh SIEM Specialist
3+ years of experience as a Cyber Security Engineer & active Bank SOC/CERT Analyst. I deploy, tune, and scale open-source SIEM architectures - specifically Wazuh - to build production-grade defense pi...
About this Gig
AUTOMATED INCIDENT RESPONSE WAZUH FIGHTS BACK AUTOMATICALLY
Most Wazuh setups generate alerts. But this setup will block, isolate, and respond before you even open your laptop.
I'm a SOC/CERT Analyst at a banking-sector data center.
Automated response isn't optional where I work; it's essential.
BASIC Auto-Blocking
- RDP & SSH brute-force auto-block
- Custom Bash & PowerShell response scripts
- Email + webhook alerting
STANDARD Endpoint Defense
- Ransomware detection via FIM triggers
- Automated host isolation (Windows & Linux)
- Slack/Telegram/Discord alerts + AbuseIPDB intel
PREMIUM SOAR-Lite Pipeline
- Wazuh TheHive auto case creation
- VirusTotal/Cortex IOC enrichment
- MITRE ATT&CK mapped playbooks
WHAT I NEED FROM YOU
- SSH access to Wazuh manager
- Endpoint OS types
- Preferred alert channel
Message me first, I'll review your current setup and recommend exactly what will work best.
Device:
Desktop
•
Laptop
•
Server
•
Router
Operating system:
Windows
•
Linux
•
Ubuntu
My Portfolio
FAQ
Do I need Wazuh already installed for this gig?
Yes - this gig assumes you have a running Wazuh manager with at least one agent. If you need a full SIEM setup first, check my Gig 1 (Wazuh deployment) and bundle it with the other Gigs for a discount.
Will the auto-blocking affect legitimate users?
I configure safe thresholds (e.g., 5+ failed logins in 60 seconds before triggering a block) and whitelist your known IPs before enabling any active response. No production-impacting change goes live without your confirmation.
What is host isolation and when is it triggered?
Host isolation cuts a compromised endpoint's network access while keeping the Wazuh agent connected to the manager. It triggers on high-confidence events like ransomware file activity or confirmed malware execution — not false positives.
Does this work on Windows endpoints?
Yes. I write PowerShell-based active response scripts for Windows and Bash-based for Linux. Both are tested end-to-end before delivery.
