Wazuh + AWS Bedrock: S3 Vectors for SOC Knowledge (Part 4)

 Posted on October 6, 2026  |  14 minutes  |  2980 words  |  pyToshka  • Other languages: Русский

Moving the knowledge corpus out of the Indexer

Part 3 ended with a condition, not a recommendation: the vector index belongs inside the Wazuh Indexer while the corpus is small and the clients already speak OpenSearch, and belongs somewhere else when the vector engine matters, when the corpus outgrows a single node, or when alert ingestion already claims that node’s CPU and heap. This part tests the other side of that condition. The same four sources went into Amazon S3 Vectors through an Amazon Bedrock Knowledge Base, the in-Indexer branch was rebuilt from the same snapshot so both could be measured on the same day, and the same frozen questions ran against both.

[Read More]
devsecops  wazuh  security  aws  s3  bedrock  llm  ai  rag  embeddings  vector search  knowledge base  cybersecurity  threat intelligence  security operations  cloud security  mcp  opensearch 

Wazuh + AWS Bedrock: RAG with Titan Embeddings (Part 3)

 Posted on September 5, 2026  (Last modified on October 6, 2026)  |  33 minutes  |  6921 words  |  pyToshka  • Other languages: Русский

Introduction

Ask the chat agent from Part 1 what the team runbook prescribes for an SSH brute force against web-server-01, or ask the MCP sidecar from Part 2 whether a file hash appeared in a threat intelligence feed last month, and the answer is whatever Claude remembers about the world in general. Both tools query alerts well. Neither of them can read a document, and the runbook, the manual and the feed never reach the model.

[Read More]
devsecops  wazuh  security  aws  docker  llm  ai  machine learning  cybersecurity  automation  threat intelligence  security operations  cloud security  mcp  rag  embeddings  opensearch  mitre  misp