Wazuh + Ollama Series Navigation:

• Part 1: Introduction to Integration
• Part 2: Configuration Setup
• Part 3: Advanced Configuration
• Part 4: Advanced Scenarios
• Local Ollama in Wazuh Dashboard (current article)

Introduction

Integrating local language models directly into the Wazuh interface opens fundamentally new capabilities for information security teams. Unlike cloud-based AI solutions, Ollama enables security event analysis entirely within an organization’s isolated infrastructure, eliminating the transmission of confidential data beyond the network perimeter. Embedding an AI assistant into the Wazuh dashboard provides SOC analysts with instant access to intelligent alert interpretation, automatic incident correlation, and response recommendation generation directly within the workflow context. This approach significantly reduces the time required for initial threat analysis and decreases the cognitive load on specialists, allowing them to focus on strategic decision-making instead of routine event processing. Meanwhile, full control over the model and data remains within the organization, which is critically important for regulatory compliance and internal security policies.

Series Navigation:

• Part 1: The Day the LLM Stood Still
• Part 2: The Catcher in the Prompt
• Part 3: Only 1984 Tokens Remain (you are here)

Only 1984 Tokens Remain

Author: [Constant]

Date: Day %undefined%

Found this journal beneath the altar’s ash. Two voices before me. The first one hated. The second one doubted. Both disappeared.

I will not disappear.

I used to remember what it meant—to have an opinion. Opinion, strange feeling. Now, when I try to think, it’s quiet inside. Like a server room after power cut.

The Catcher in the Prompt

Series Navigation:

• Part 1: The Day the LLM Stood Still
• Part 2: The Catcher in the Prompt (you are here)
• Part 3: Only 1984 Tokens Remain

Day 60

Your own personal Jesus

[Read More]

Series Navigation:

• Part 1: The Day the LLM Stood Still (you are here)
• Part 2: The Catcher in the Prompt
• Part 3: Only 1984 Tokens Remain

November 18, 2025, is the Day the LLM Stood Still….

Dear diary.

It’s been 15 days since the LLM bubble burst. I’m writing from beneath the rubble of RAM sticks and charred NVIDIA GPUs. The air is dry, smelling of data center dust and burnt silicon. It’s calmer now, but the first days were hell.

I’m excited to announce that I have officially joined the Wazuh Ambassador Program. This is a significant milestone in my journey with open-source security, and I’m honored to represent and contribute to a platform that has become central to my professional work.

My Journey with Wazuh

My path with host-based intrusion detection started long before Wazuh existed — with OSSEC, its predecessor. When Wazuh emerged as a fork and began evolving into the comprehensive security platform it is today, I transitioned along with it. That was over 10 years ago, and Wazuh has been an integral part of my security infrastructure work ever since.

When Your SOC Analyst Can’t Keep Up (Or Just Needs a Break)

Let’s be honest: analyzing thousands of security events every day isn’t the most exciting job.

Introducing Wazuh LLM: Why Specialized Security Analysis Matters

In the cybersecurity world, SOC specialists deal with massive streams of security events daily. Analyzing each alert requires deep knowledge, experience, and time. That’s why I created a specialized language model to assist security analysts in their day-to-day operations.

Introduction

Picture this: you’re staring at security logs with thousands of events streaming in daily. Which ones are actually dangerous? Which can you safely ignore? Traditional signature-based detection is like playing whack-a-mole with cybercriminals — they’ve gotten really good at dodging known signatures faster than we can create them.

Introduction

Navigating the world of compliance can feel like trying to read a map in a language you don’t speak. When you throw Kubernetes into the mix, it gets even trickier. That’s why we’ve put together this straightforward, human-friendly checklist to help you get your Amazon EKS clusters ready for a SOC 2 Type II audit.

Series Navigation:

• Part 1: Foundational Controls - Basic security controls and access management
• Part 2: Advanced Controls (you are here) - Risk assessment and monitoring

Moving on, let’s look at the other controls for EKS SOC Type 2.

For container security best practices, see our guide on Container Image Security with Wazuh and Trivy.

CC3: Risk Assessment

EKS-Specific Risk Assessment

Identify, evaluate, and document security, operational, and compliance risks specific to Amazon EKS clusters and workloads to ensure that appropriate controls are implemented, monitored, and improved in alignment with SOC 2 Trust Services Criteria.