diff --git a/CHANGELOG.md b/CHANGELOG.md
index 17848515..0ba3c2bf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
+- Add missing malicious-ioc ruleset lists ([#1685](https://github.com/wazuh/wazuh-ansible/pull/1685))
 - Integrate bumper script via GitHub action. ([#1676](https://github.com/wazuh/wazuh-ansible/pull/1676))
 - Added repository_bumper.sh script. ([#1621](https://github.com/wazuh/wazuh-ansible/pull/1621))
 
diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml
index 408468f9..8438c7ce 100644
--- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml
+++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml
@@ -296,6 +296,9 @@ wazuh_manager_ruleset:
     - 'audit-keys'
     - 'security-eventchannel'
     - 'amazon/aws-eventnames'
+    - 'malicious-ioc/malicious-ip'
+    - 'malicious-ioc/malicious-domains'
+    - 'malicious-ioc/malware-hashes'
 
 wazuh_manager_rule_exclude:
   - '0215-policy_rules.xml'