Wazuh + AWS Bedrock: S3 Vectors for SOC Knowledge (Part 4)

 Posted on October 6, 2026  |  14 minutes  |  2980 words  |  pyToshka  • Other languages: Русский

Moving the knowledge corpus out of the Indexer

Part 3 ended with a condition, not a recommendation: the vector index belongs inside the Wazuh Indexer while the corpus is small and the clients already speak OpenSearch, and belongs somewhere else when the vector engine matters, when the corpus outgrows a single node, or when alert ingestion already claims that node’s CPU and heap. This part tests the other side of that condition. The same four sources went into Amazon S3 Vectors through an Amazon Bedrock Knowledge Base, the in-Indexer branch was rebuilt from the same snapshot so both could be measured on the same day, and the same frozen questions ran against both.

[Read More]
devsecops  wazuh  security  aws  s3  bedrock  llm  ai  rag  embeddings  vector search  knowledge base  cybersecurity  threat intelligence  security operations  cloud security  mcp  opensearch 

Wazuh + AWS Bedrock: RAG with Titan Embeddings (Part 3)

 Posted on September 5, 2026  (Last modified on October 6, 2026)  |  33 minutes  |  6921 words  |  pyToshka  • Other languages: Русский

Introduction

Ask the chat agent from Part 1 what the team runbook prescribes for an SSH brute force against web-server-01, or ask the MCP sidecar from Part 2 whether a file hash appeared in a threat intelligence feed last month, and the answer is whatever Claude remembers about the world in general. Both tools query alerts well. Neither of them can read a document, and the runbook, the manual and the feed never reach the model.

[Read More]
devsecops  wazuh  security  aws  docker  llm  ai  machine learning  cybersecurity  automation  threat intelligence  security operations  cloud security  mcp  rag  embeddings  opensearch  mitre  misp 

Wazuh MCP Server: Claude Desktop + OpenSearch (Part 2)

 Posted on March 23, 2026  (Last modified on October 6, 2026)  |  9 minutes  |  1844 words  |  pyToshka  • Other languages: Русский

Introduction

In Part 1 we connected AWS Bedrock Claude to the Wazuh Dashboard chat via ML Commons. That approach works well for analysts working inside the Wazuh UI. In this part we open a second channel: Model Context Protocol (MCP), which allows any compatible client - Claude Desktop, custom applications, CI pipelines - to query Wazuh Indexer data through a standardized tool interface.

[Read More]
wazuh  aws  bedrock  mcp  llm  ai  security  devsecops  docker  opensearch  siem  claude  threat analysis  security monitoring  automation 

Wazuh + AWS Bedrock: AI Security in Docker (Part 1)

 Posted on March 16, 2026  (Last modified on October 6, 2026)  |  8 minutes  |  1550 words  |  pyToshka  • Other languages: Русский

Introduction

In the previous article we embedded a local Ollama model directly into the Wazuh Dashboard chat via ML Commons. That approach provides full control over data with no cloud dependencies. In this series we take a parallel path: using AWS Bedrock - specifically Claude Sonnet 4.5 - as the inference backend, while all security data stays strictly within the local Docker network.

[Read More]
devsecops  wazuh  security  aws  docker  llm  ai  machine learning  cybersecurity  automation  monitoring  threat intelligence  security operations  cloud security  mcp