diff --git a/source/compliance/gdpr/gdpr-IV.rst b/source/compliance/gdpr/gdpr-IV.rst index caefcc1038..903ee683f4 100644 --- a/source/compliance/gdpr/gdpr-IV.rst +++ b/source/compliance/gdpr/gdpr-IV.rst @@ -364,5 +364,5 @@ Wazuh helps meet this article of the GDPR by providing security measures such as - :doc:`Integrating with VirusTotal to detect and remove malware `. - :doc:`Integrating with YARA to detect malware `. - `Using constant database (CDB) lists to detect and remove malicious files `__. -- :doc:`Active response `. +- :doc:`Active Response `. - :doc:`Vulnerability detection `. diff --git a/source/compliance/hipaa/active-response.rst b/source/compliance/hipaa/active-response.rst index d2eaa464dd..8f594a4ee4 100644 --- a/source/compliance/hipaa/active-response.rst +++ b/source/compliance/hipaa/active-response.rst @@ -3,7 +3,7 @@ .. meta:: :description: The Active Response module assists in meeting HIPAA compliance. Learn more about it in this section of the Wazuh documentation. -Active response +Active Response =============== The Wazuh Active Response module is configured to automatically execute scripts when events match specified rules in the Wazuh ruleset. These scripts may perform a firewall block or drop, traffic shaping or throttling, account lockout, or any other user defined action. diff --git a/source/compliance/nist/active-response.rst b/source/compliance/nist/active-response.rst index 8b5423225f..cdf3e2d790 100644 --- a/source/compliance/nist/active-response.rst +++ b/source/compliance/nist/active-response.rst @@ -3,7 +3,7 @@ .. meta:: :description: The Active Response module performs autonomous actions on endpoints to mitigate security threats. Learn more about it in this section of the documentation. -Active response +Active Response =============== The Wazuh Active Response module performs autonomous actions on endpoints to mitigate security threats. You can configure the module to automatically execute scripts when specific alerts trigger. These scripts execute actions, such as a firewall block or drop, traffic shaping or throttling, and account lockout. diff --git a/source/deployment-options/deploying-with-puppet/wazuh-puppet-module/index.rst b/source/deployment-options/deploying-with-puppet/wazuh-puppet-module/index.rst index 779807d2d5..514274b10a 100644 --- a/source/deployment-options/deploying-with-puppet/wazuh-puppet-module/index.rst +++ b/source/deployment-options/deploying-with-puppet/wazuh-puppet-module/index.rst @@ -383,7 +383,7 @@ Reference Wazuh puppet | | | | | | :ref:`Misc ` | | +-----------------------------------------------------------------+-----------------------------------------------------------------+---------------------------------------------+ -| :ref:`Wazuh agent class ` | :ref:`Active response ` | | +| :ref:`Wazuh agent class ` | :ref:`Active Response ` | | | | | | | | :ref:`Agent enrollment ` | | | | | | diff --git a/source/getting-started/components/wazuh-agent.rst b/source/getting-started/components/wazuh-agent.rst index 287d272787..000e99f67d 100644 --- a/source/getting-started/components/wazuh-agent.rst +++ b/source/getting-started/components/wazuh-agent.rst @@ -40,7 +40,7 @@ All agent modules are configurable and perform different security tasks. This mo - **Malware detection:** Using a non-signature-based approach, this component is capable of detecting anomalies and the possible presence of rootkits. Also, it looks for hidden processes, hidden files, and hidden ports while monitoring system calls. -- **Active response:** This module runs automatic actions when threats are detected, triggering responses to block a network connection, stop a running process, or delete a malicious file. Users can also create custom responses when necessary and customize, for example, responses for running a binary in a sandbox, capturing network traffic, and scanning a file with an antivirus. +- **Active Response:** This module runs automatic actions when threats are detected, triggering responses to block a network connection, stop a running process, or delete a malicious file. Users can also create custom responses when necessary and customize, for example, responses for running a binary in a sandbox, capturing network traffic, and scanning a file with an antivirus. - **Container security monitoring:** This agent module is integrated with the Docker Engine API to monitor changes in a containerized environment. For example, it detects changes to container images, network configuration, or data volumes. Besides, it alerts about containers running in privileged mode and about users executing commands in a running container. diff --git a/source/installation-guide/wazuh-agent/index.rst b/source/installation-guide/wazuh-agent/index.rst index 6231101b60..74356521bb 100644 --- a/source/installation-guide/wazuh-agent/index.rst +++ b/source/installation-guide/wazuh-agent/index.rst @@ -24,7 +24,7 @@ The Wazuh agent provides :ref:`key features ` to enhance your sy - Security configuration assessment (SCA) * - System inventory - Malware detection - * - Active response + * - Active Response - Container security * - Cloud security - diff --git a/source/proof-of-concept-guide/leveraging-llms-for-alert-enrichment.rst b/source/proof-of-concept-guide/leveraging-llms-for-alert-enrichment.rst index 7d61b5b541..e1c465b38f 100644 --- a/source/proof-of-concept-guide/leveraging-llms-for-alert-enrichment.rst +++ b/source/proof-of-concept-guide/leveraging-llms-for-alert-enrichment.rst @@ -646,8 +646,8 @@ As seen in the image, ChatGPT provides more context to the malicious file detect :width: 80% .. thumbnail:: /images/poc/chatgpt-active-response-ubuntu-alert.png - :title: Active response - :alt: Active response + :title: Active Response + :alt: Active Response :align: center :width: 80% @@ -683,8 +683,8 @@ As seen in the image, ChatGPT provides more context to the malicious file detect :width: 80% .. thumbnail:: /images/poc/chatgpt-active-response-windows-alert.png - :title: Active response - :alt: Active response + :title: Active Response + :alt: Active Response :align: center :width: 80% diff --git a/source/user-manual/capabilities/active-response/ar-use-cases/blocking-ssh-brute-force.rst b/source/user-manual/capabilities/active-response/ar-use-cases/blocking-ssh-brute-force.rst index 8490e59a99..8953a2abc1 100644 --- a/source/user-manual/capabilities/active-response/ar-use-cases/blocking-ssh-brute-force.rst +++ b/source/user-manual/capabilities/active-response/ar-use-cases/blocking-ssh-brute-force.rst @@ -136,8 +136,8 @@ Monitored Linux/Unix endpoints have a log file at ``/var/ossec/logs/active-respo When the active response triggers, a corresponding alert appears on the Wazuh dashboard. .. thumbnail:: /images/manual/active-response/ar-alert-fired.png - :title: Active response alert: Host Blocked by firewall-drop - :alt: Active response alert: Host Blocked by firewall-drop + :title: Active Response alert: Host Blocked by firewall-drop + :alt: Active Response alert: Host Blocked by firewall-drop :align: center :width: 80% diff --git a/source/user-manual/capabilities/active-response/ar-use-cases/disabling-user-account.rst b/source/user-manual/capabilities/active-response/ar-use-cases/disabling-user-account.rst index 831bfa7614..d9f05edb38 100644 --- a/source/user-manual/capabilities/active-response/ar-use-cases/disabling-user-account.rst +++ b/source/user-manual/capabilities/active-response/ar-use-cases/disabling-user-account.rst @@ -122,7 +122,7 @@ Visualize the alerts You can visualize the alert data on the Wazuh dashboard. In the image below, you can see that the active response triggers just after rule ID ``120100`` fires to disable the account. Then re-enables it again after 5 minutes. .. thumbnail:: /images/manual/active-response/ar-alert-fired3.png - :title: Active response alert: User account disabled - :alt: Active response alert: User account disabled + :title: Active Response alert: User account disabled + :alt: Active Response alert: User account disabled :align: center :width: 80% diff --git a/source/user-manual/capabilities/active-response/ar-use-cases/index.rst b/source/user-manual/capabilities/active-response/ar-use-cases/index.rst index ea9e6b60cb..3351af3bca 100644 --- a/source/user-manual/capabilities/active-response/ar-use-cases/index.rst +++ b/source/user-manual/capabilities/active-response/ar-use-cases/index.rst @@ -1,7 +1,7 @@ .. Copyright (C) 2015, Wazuh, Inc. .. meta:: - :description: Find out some Active response use cases in this section of the Wazuh documentation. + :description: Find out some Active Response use cases in this section of the Wazuh documentation. .. _active_response_use_cases: diff --git a/source/user-manual/capabilities/active-response/ar-use-cases/restarting-wazuh-agent.rst b/source/user-manual/capabilities/active-response/ar-use-cases/restarting-wazuh-agent.rst index 8f597f5f05..de90be048f 100644 --- a/source/user-manual/capabilities/active-response/ar-use-cases/restarting-wazuh-agent.rst +++ b/source/user-manual/capabilities/active-response/ar-use-cases/restarting-wazuh-agent.rst @@ -109,7 +109,7 @@ Visualize the alerts You can visualize the alert data on the Wazuh dashboard. .. thumbnail:: /images/manual/active-response/ar-alert-fired2.png - :title: Active response alert: The Wazuh agent was restarted - :alt: Active response alert: The Wazuh agent was restarted + :title: Active Response alert: The Wazuh agent was restarted + :alt: Active Response alert: The Wazuh agent was restarted :align: center :width: 80% diff --git a/source/user-manual/capabilities/active-response/index.rst b/source/user-manual/capabilities/active-response/index.rst index b345292a99..2ea40e8cf9 100644 --- a/source/user-manual/capabilities/active-response/index.rst +++ b/source/user-manual/capabilities/active-response/index.rst @@ -1,9 +1,9 @@ .. Copyright (C) 2015, Wazuh, Inc. .. meta:: - :description: Active response executes scripts in response to specific alerts. Learn more about it here. + :description: Active Response executes scripts in response to specific alerts. Learn more about it here. -Active response +Active Response =============== Security teams often encounter problems in incident response such as addressing high severity events in a timely manner or providing complete mitigation actions. They might struggle to collect relevant information in real time, which makes it difficult to understand the full scope of an incident. These problems increase the difficulty to contain and mitigate the impact of a cyberattack.