Active Response lets Wazuh run a script on the agent (or manager) when a rule of a given level or ID fires. The built-in firewall-drop response blocks the source IP via iptables (Linux), netsh (Windows) or pf (macOS) for a configurable duration.
1. Define the command on the manager
<command>
<name>firewall-drop</name>
<executable>firewall-drop</executable>
<timeout_allowed>yes</timeout_allowed>
</command>2. Trigger on SSH brute force
<active-response>
<command>firewall-drop</command>
<location>local</location>
<rules_id>5712</rules_id>
<timeout>600</timeout>
</active-response>Rule 5712 fires after multiple sshd authentication failures from the same IP. The agent will iptables -I INPUT -s <IP> -j DROP for 600 seconds.
3. Restart the manager
systemctl restart wazuh-manager4. Verify on the agent
tail -f /var/ossec/logs/active-responses.log
iptables -L INPUT -n | grep DROPNote: Always whitelist your admin IPs to avoid locking yourself out. Use the <repeated_offenders> directive to escalate timeouts on repeat attackers.
Our team builds custom Active Response playbooks (isolate host, disable AD user, kill process), contact us for SOAR-style automation.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see: