Wazuh SOC Investigation

The Wazuh SOC Investigation app provides security operations workflows and analytical dashboards for investigating endpoint security alerts generated by Wazuh. The app includes a modular input that retrieves vulnerability assessment findings from the Wazuh Indexer API and brings them into Splunk for correlation and analysis. Alert data is normalized to the CIM Intrusion Detection data model, enabling integration with other security tools and Enterprise Security. The app supports investigation of file integrity events, authentication activities, and MITRE ATT&CK-mapped threat behaviors across monitored endpoints. For details: https://github.com/kaledaljebur/wazuh-soc-investigation