Comparative Analysis of YARA and VirusTotal Integrations with Wazuh for Enhanced Malware Detection

For modern cybersecurity defenses, efficient malware detection and response are essential. This paper examines and compares the integration of YARA and VirusTotal with Wazuh, an open-source security information and event management (SIEM) platform with a focus on their ability to identify malware using the EICAR test file, a standardized test sample used to assess antivirus results. The configuration processes for both integrations are assessed, along with their overall effects on detection accuracy, response time and resource usage as well as how well they detect the EICAR test file. According to evaluation results, VirusTotal and YARA gain same results in terms of detection accuracy when it comes to detecting known malware. For response time, YARA’s local processing capabilities outperform VirusTotal significantly as the number of samples increases. For resource usage, YARA uses less memory and CPU because of its local processing, while VirusTotal uses more resources because of its multi-engine scanning method.