[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-36544-en":3,"doc-seo-36544-105":29,"detail-sidebar-cat-0-en-105":90},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},36544,1099513958762,"Logic","https://ap-avatar.wpscdn.com/avatar/1000023916a998db790?x-image-process=image/resize,m_fixed,w_180,h_180&k=1782109480056885918",8,"Research & Report","Automating Malware Detection and Response via Real-Time Threat Feed Integration with Wazuh SIEM","An open-source, modular framework enhances the Wazuh Security Information and Event Management (SIEM) system by integrating real-time threat intelligence feeds to improve malware detection and automate incident response. The approach dynamically queries live Indicators of Compromise (IOCs) from VirusTotal and AbuseIPDB to enrich incoming log events, then uses a threshold-based correlation engine to produce precise alerts. Active response scripts mitigate threats through IP blocking and file quarantine, using scalable JSON parsing and modular feed integration. Evaluations in an enterprise-grade testbed show 95.0% detection rate, 94.2% alert precision, and 2.8s average mitigation delay.","","cbCainLg5u6CngmL","https://ap.wps.com/l/cbCainLg5u6CngmL","pdf",2887917,1,6,"English","en",105,"# Introduction\n# Related Work\n## Threat Intelligence in SIEM\n## Threat Intelligence Sources and Integration\n# Proposed Framework\n## Real-Time IOC Querying\n## Correlation Engine and Alerting\n## Active Response and Mitigation\n# Experimental Evaluation\n## Test Environment\n## Metrics and Results","[{\"question\":\"How does the framework enhance Wazuh SIEM with threat intelligence?\",\"answer\":\"It enriches Wazuh log events by dynamically querying live Indicators of Compromise (IOCs) from VirusTotal and AbuseIPDB when events are reported by Wazuh agents.\"},{\"question\":\"What mechanism generates alerts after log enrichment?\",\"answer\":\"A custom correlation engine evaluates enriched logs using threshold-based rules to generate precise alerts when matches are found.\"},{\"question\":\"What automated actions are triggered during incident response?\",\"answer\":\"Active response scripts perform realtime mitigation such as IP blocking and file quarantine to reduce response time.\"}]",1782939837,15,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":15,"description":14,"schema_data":33,"social_meta":85,"head_meta":87,"extra_data":89,"updated_unix":27},"automating-malware-detection-and-response-via-real-time-threat-feed-integration-with-wazuh-siem-36544",{"@graph":34,"@context":84},[35,52,67],{"@type":36,"itemListElement":37},"BreadcrumbList",[38,42,46,49],{"item":39,"name":40,"@type":41,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":43,"name":44,"@type":41,"position":45},"https://docshare.wps.com/document/","Document",2,{"item":47,"name":12,"@type":41,"position":48},"https://docshare.wps.com/document/research-report/",3,{"item":50,"name":13,"@type":41,"position":51},"https://docshare.wps.com/document/automating-malware-detection-and-response-via-real-time-threat-feed-integration-with-wazuh-siem-36544/36544/",4,{"url":50,"name":13,"@type":53,"author":54,"headline":13,"publisher":56,"fileFormat":59,"inLanguage":23,"description":14,"dateModified":60,"datePublished":61,"encodingFormat":59,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":55},"Person",{"url":39,"name":57,"@type":58},"DocShare","Organization","application/pdf","2026-07-10","2026-07-01",true,{"@type":64,"interactionType":65,"userInteractionCount":20},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70,76,80],{"name":71,"@type":72,"acceptedAnswer":73},"How does the framework enhance Wazuh SIEM with threat intelligence?","Question",{"text":74,"@type":75},"It enriches Wazuh log events by dynamically querying live Indicators of Compromise (IOCs) from VirusTotal and AbuseIPDB when events are reported by Wazuh agents.","Answer",{"name":77,"@type":72,"acceptedAnswer":78},"What mechanism generates alerts after log enrichment?",{"text":79,"@type":75},"A custom correlation engine evaluates enriched logs using threshold-based rules to generate precise alerts when matches are found.",{"name":81,"@type":72,"acceptedAnswer":82},"What automated actions are triggered during incident response?",{"text":83,"@type":75},"Active response scripts perform realtime mitigation such as IP blocking and file quarantine to reduce response time.","https://schema.org",{"og:url":50,"og:type":86,"og:title":13,"og:site_name":57,"og:description":14},"article",{"robots":88,"canonical":50},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":91},[92,96,100,104,109,113,118,121,126,129,133],{"id":20,"doc_module":4,"doc_module_name":44,"category_name":93,"show_sort_weight":94,"slug":95},"Story & Novel",90,"story-novel",{"id":45,"doc_module":4,"doc_module_name":44,"category_name":97,"show_sort_weight":98,"slug":99},"Literature",80,"literature",{"id":51,"doc_module":4,"doc_module_name":44,"category_name":101,"show_sort_weight":102,"slug":103},"Exam",70,"exam",{"id":105,"doc_module":4,"doc_module_name":44,"category_name":106,"show_sort_weight":107,"slug":108},5,"Comic",60,"comic",{"id":21,"doc_module":4,"doc_module_name":44,"category_name":110,"show_sort_weight":111,"slug":112},"Technology",50,"technology",{"id":114,"doc_module":4,"doc_module_name":44,"category_name":115,"show_sort_weight":116,"slug":117},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":44,"category_name":12,"show_sort_weight":119,"slug":120},30,"research-report",{"id":122,"doc_module":4,"doc_module_name":44,"category_name":123,"show_sort_weight":124,"slug":125},9,"Religion & Spirituality",20,"religion-spirituality",{"id":124,"doc_module":4,"doc_module_name":44,"category_name":127,"show_sort_weight":124,"slug":128},"World Cup","world-cup",{"id":130,"doc_module":4,"doc_module_name":44,"category_name":131,"show_sort_weight":130,"slug":132},10,"Lifestyle","lifestyle",{"id":134,"doc_module":4,"doc_module_name":44,"category_name":135,"show_sort_weight":105,"slug":136},19,"General","general"]