Skip to main content

Playbooks

Use this section to review practical IDS response workflows for common scenarios. Adapt each playbook to your local processes and tooling.

Under-Attack Instance​

When a CI shows an Under attack IDS status or a burst of high or critical alerts:

  1. Identify the affected CI in Cloudaware CMDB and confirm ownership, environment, and criticality.
  2. Review recent IDS alerts in Wazuh dashboards.
  3. Contain impact where appropriate (for example, isolate the host, block access, or scale in affected nodes).
  4. Coordinate with application and infrastructure owners to validate behavior and apply fixes.
  5. Create or update incident and change records; ensure IDS findings are linked.
  6. After remediation, verify that alerts stop and IDS status returns to Monitored.

Suspicious Privileged Activity​

When IDS flags unusual sudo or root usage or admin logins:

  1. Pivot from the alert to the user, host, and timeframe in Wazuh.
  2. Check Cloudaware CMDB for planned changes or maintenance windows involving that CI.
  3. Validate whether the activity was expected; if not, escalate to security for investigation.
  4. Consider adding additional rules or detections if a new abuse pattern was discovered.

Configuration or File Integrity Drift​

When IDS detects unexpected changes to critical files or configurations:

  1. Compare the change to known deployment artifacts such as configuration management and CI/CD pipelines.
  2. If the change is unauthorized, roll back using configuration management or backup tools.
  3. Add or adjust IDS rules to better differentiate between authorized and unauthorized changes.
  4. Document the outcome and feed lessons learned into hardening guides and baselines.

Periodic Coverage Review​

On a regular cadence, for example, monthly or quarterly:

  1. Use Cloudaware CMDB to list critical services and check IDS status coverage.
  2. Ensure all in-scope hosts and nodes have active agents and a healthy status.
  3. Review top IDS rules, severities, and noisy sources; tune rules and exceptions.
  4. Confirm dashboards and reports used by management and compliance remain accurate and relevant.