$ cat wazuh-content/WAZUH-UPSTREAM-GRANT.md
pathwazuh-content/WAZUH-UPSTREAM-GRANT.md
size1570 bytes
modified2026-09-12
licenseAGPL-3.0-or-later
sha256aff18f7ace25dd39f0612fdc766faf497e5bff0108cbe7cc443193002007ce89
rawup
# Additional licensing grant for the Wazuh project

Copyright (C) 2026 Point Arena Cyber Security

The detection rules, decoders, and CDB lists in this repository are offered to
the public under the GNU Affero General Public License, version 3 or later, as
stated in `LICENSE`.

Separately, and solely so that this content can be incorporated into the Wazuh
project's own distributed ruleset, Point Arena Cyber Security grants to Wazuh
Inc. and the Wazuh project a non-exclusive, irrevocable, worldwide,
royalty-free right to use, modify, and redistribute any rule, decoder, or CDB
list contained in this repository under the terms of the GNU General Public
License, version 2, or any later version published by the Free Software
Foundation.

## Scope of this grant

This grant is limited to the Wazuh project. It extends to no other party.

It does not change the license under which this content is offered to anyone
else. Every other recipient receives it under AGPL-3.0-or-later and under those
terms only, including the network interaction requirement in section 13.

This grant is not a contributor license agreement and transfers no copyright.
Point Arena Cyber Security remains the copyright holder.

## Why this exists

Wazuh is licensed GPLv2. GPLv2 and AGPLv3 cannot be combined in a single work,
so content published only under AGPL could never be accepted upstream into the
shipped Wazuh ruleset. This grant keeps that path open without weakening the
terms that apply to everyone else.

## Requesting upstreaming

Contact hello@pointarenacybersecurity.dev.

License. Code and detection content is AGPL-3.0-or-later. If you modify it and run it for others over a network, including as a hosted or managed service, section 13 requires you to offer those users your source. Papers and written guidance are CC BY-SA 4.0.

Verify what you got. curl -sO https://open.pointarenacybersecurity.dev/SHA256SUMS && sha256sum -c SHA256SUMS

Source of this site. This index is itself AGPL. Read it here.

Patches and questions. hello@pointarenacybersecurity.dev