Collection of scripts, tools, custom rules and decoders I created for my wazuh instance

Renames xml-files in up to two directories by matching against keyword (non-recursive). Useful for disabling rulefiles in bulk

chmod +x rename_xml.sh

./rename_xml.sh "keyword" "dir1" "dir2" 

./rename_xml.sh "sysmon" "/var/ossec/etc/rules/" "/var/ossec/ruleset/rules" 

check if id is free or already in use

chmod +x check_rule-id.sh

./check_rule-id.sh "rule.id"

./check_rule-id.sh start.id-end.id

./check_rule-id.sh 10000-10010

creates a table with all used rule.id's, rule.description and rule filepath and saves it to a txt which then can be grepped or exported

chmod +x map_rules.sh

./map_rules.sh