Wazuh + AWS Bedrock: S3 Vectors for SOC Knowledge (Part 4)
Move a SOC corpus of 7115 chunks out of the Wazuh Indexer into Amazon S3 Vectors through Bedrock Knowledge Bases, and measure retrieval, cost and what breaks.
Yuriy Medvedev (pyToshka), Principal Cloud & DevSecOps Engineer in Dubai. Field notes and repeatable playbooks on Wazuh SIEM, AWS security and AI/ML infrastructure.
Move a SOC corpus of 7115 chunks out of the Wazuh Indexer into Amazon S3 Vectors through Bedrock Knowledge Bases, and measure retrieval, cost and what breaks.
Read the postMove a SOC corpus of 7115 chunks out of the Wazuh Indexer into Amazon S3 Vectors through Bedrock Knowledge Bases, and measure retrieval, cost and what breaks.
Two stands side by side: what an indexer outage run showed, how the failure boundary moved, what happens to XML rules, and how a finding differs from an alert.
Build a RAG pipeline inside Wazuh Indexer: Titan Embeddings V2, a lucene k-NN index over MITRE ATT&CK, docs, playbooks and MISP IOCs, wired into chat and MCP.
Learn how wazuh-linter evolved from a decoder-only tool into a unified platform validating both rules and decoders with cross-type checking and 24 rules.
Deploy opensearch-mcp-server-py with Wazuh Indexer in Docker and analyze security alerts via Claude Desktop using Model Context Protocol and examples.
Deploy Wazuh with AWS Bedrock integration using MCP in Docker. Build AI-powered security analytics with step-by-step setup for threat detection and analysis.
My journey from Wazuh Ambassador to AWS Community Builder in the Security category. How open-source SIEM expertise led to cloud security community recognition.
Build a static analysis tool for Wazuh decoder XML files. Validate syntax, detect misconfigurations, and enforce decoder best practices in CI/CD pipelines.
Integrate a local Ollama LLM into your Wazuh dashboard for AI-powered security event analysis. Step-by-step guide for private, on-premise threat analysis.
Joining the Wazuh Ambassador Program. My 10+ years journey with OSSEC and Wazuh, open-source contributions, and future plans for the security community.
Full-text feeds of new posts, one per language.