chris/wazuh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
chris
2026-06-05 18:34:24 +00:00
parent 0cde601ef0
commit 6a0594fd1c
1 changed files with 0 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
-4
View File
@@ -346,12 +346,8 @@ tail -f /var/ossec/logs/alerts/alerts.log
## Known Gaps / Future Work ## Known Gaps / Future Work
- **XFF / real client IP** - Web traffic through NPM means web attack alerts attribute NPM's IP as the source. Custom XFF decoder not yet written.
- **Mailcow Postfix/rspamd rules** - Suppression rules are in place; detection rules (spam relay attempts, auth failures) not yet written. - **Mailcow Postfix/rspamd rules** - Suppression rules are in place; detection rules (spam relay attempts, auth failures) not yet written.
- **Active response** - `firewall-drop` and `host-deny` commands are defined but no active response blocks are configured. Not enabled. - **Active response** - `firewall-drop` and `host-deny` commands are defined but no active response blocks are configured. Not enabled.
- **Whitelist placeholder** - `WHITELISTED_IPs` in the second `<global>` block needs replacing with actual LAN ranges.
- **`WAZUH_SERVER_IP` placeholder** - syslog remote listener has a placeholder local IP that needs setting.
- **`email_from` placeholder** - `YOUR_EMAIL` in `ossec.conf` needs a real address.
--- ---