Interesting, never heard of Wazuh until now. That looks closer to what Trellix allows.
The guy in charge of picking endpoint security products (whose team writes these rules) has tried Defender and found it lacking in comparison. Also, that link is about historical search for threat hunting, so I’m not sure if it’s the correct one.
Edit: I just saw the section about writing detections, but that seems to be more of a reactive than proactive approach. It still does the detection from searches.
Only run as an experiment myself but Wazuh can do it apparently: https://documentation.wazuh.com/current/proof-of-concept-guide/detect-malware-yara-integration.html
MDE can do something similar but you’ll need to rewrite your rules which is of course more than suboptimal… https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-overview?view=o365-worldwide
Interesting, never heard of Wazuh until now. That looks closer to what Trellix allows.
The guy in charge of picking endpoint security products (whose team writes these rules) has tried Defender and found it lacking in comparison. Also, that link is about historical search for threat hunting, so I’m not sure if it’s the correct one.
Edit: I just saw the section about writing detections, but that seems to be more of a reactive than proactive approach. It still does the detection from searches.