Wazuh decoder XML files define how raw log lines are parsed into structured security events. A misconfigured decoder – a missing <order> element, an orphaned parent reference, or a regex group mismatch – can silently drop critical fields from alerts, leaving blind spots in your SIEM pipeline. Manual code review catches some of these issues, but it does not scale across hundreds of decoder files shipped with Wazuh or maintained by your organization.
Ollama in Wazuh Dashboard: AI Security Analysis
Introduction
Integrating local language models directly into the Wazuh interface opens fundamentally new capabilities for information security teams. Unlike cloud-based AI solutions, Ollama enables security event analysis entirely within an organization’s isolated infrastructure, eliminating the transmission of confidential data beyond the network perimeter. Embedding an AI assistant into the Wazuh dashboard provides SOC analysts with instant access to intelligent alert interpretation, automatic incident correlation, and response recommendation generation directly within the workflow context. This approach significantly reduces the time required for initial threat analysis and decreases the cognitive load on specialists, allowing them to focus on strategic decision-making instead of routine event processing. Meanwhile, full control over the model and data remains within the organization, which is critically important for regulatory compliance and internal security policies.
[Read More]Two LLM Security Assistants for Wazuh and AWS Analysis
When Your SOC Analyst Can’t Keep Up (Or Just Needs a Break)
Let’s be honest: analyzing thousands of security events every day isn’t the most exciting job.
[Read More]Wazuh LLM: Fine-Tuned Llama 3.1 for Security Analysis
Introducing Wazuh LLM: Why Specialized Security Analysis Matters
In the cybersecurity world, SOC specialists deal with massive streams of security events daily. Analyzing each alert requires deep knowledge, experience, and time. That’s why I created a specialized language model to assist security analysts in their day-to-day operations.
[Read More]Building ML Threat Intelligence with Honeypot Data
Introduction
Picture this: you’re staring at security logs with thousands of events streaming in daily. Which ones are actually dangerous? Which can you safely ignore? Traditional signature-based detection is like playing whack-a-mole with cybercriminals — they’ve gotten really good at dodging known signatures faster than we can create them.
[Read More]Amazon EKS SOC 2 Type II Compliance Checklist part 1
Introduction
Navigating the world of compliance can feel like trying to read a map in a language you don’t speak. When you throw Kubernetes into the mix, it gets even trickier. That’s why we’ve put together this straightforward, human-friendly checklist to help you get your Amazon EKS clusters ready for a SOC 2 Type II audit.
[Read More]Amazon EKS SOC 2 Type II Compliance Checklist part 2
Moving on, let’s look at the other controls for EKS SOC Type 2.
For container security best practices, see our guide on Container Image Security with Wazuh and Trivy.
CC3: Risk Assessment
EKS-Specific Risk Assessment
Identify, evaluate, and document security, operational, and compliance risks specific to Amazon EKS clusters and workloads to ensure that appropriate controls are implemented, monitored, and improved in alignment with SOC 2 Trust Services Criteria.
[Read More]Boosting Container Image Security Using Wazuh and Trivy
This article draws inspiration from the Wazuh blog post on enhancing container image security with Wazuh and Trivy.
Containerization has revolutionized software development and deployment, offering scalability and efficiency.
However, this agility can introduce security risks if container images aren’t properly secured.
Vulnerabilities within these images can expose your entire system to threats. This is where the combined power of Wazuh and Trivy comes in.
These open-source tools provide a comprehensive solution for boosting your container image security, ensuring your applications are protected from the ground up.
[Read More]RAG for Wazuh Documentation: Step-by-Step Guide, Part 2
Related Reading:
- Wazuh Integration with Ollama Series - Learn how to integrate Wazuh with Ollama
- Wazuh LLM Security Event Analysis - Specialized model for Wazuh events
Prerequisites and Environment Setup
For local RAG development, ensure you have the following requirements:
[Read More]RAG for Wazuh Documentation: Step-by-Step Guide, Part 1
Introduction to RAG
Retrieval-Augmented Generation (RAG) is a method that allows the use of information from various sources to generate more accurate and useful responses to questions.
[Read More]