Monitoring

The first thing 5.0 broke for me was not a feature. It was a habit.

When something looks stuck on a Wazuh 4.x server, you restart the manager. It is the cheapest diagnostic move there is, and on the 4.x installations I have run it has been safe, because by the time the manager restarts the alert is already written to disk. So I did the same thing on a 5.0.0 Beta 5 stand while its indexer happened to be down. Of the hundred events whose presence in the agent file was confirmed before that restart, none reached the indexer afterwards. How many the manager had already accepted I cannot say: 5.0 exposes no point between acceptance and indexing, which is part of what this comparison is about.

Introduction

In the previous article we embedded a local Ollama model directly into the Wazuh Dashboard chat via ML Commons. That approach provides full control over data with no cloud dependencies. In this series we take a parallel path: using AWS Bedrock - specifically Claude Sonnet 4.5 - as the inference backend, while all security data stays strictly within the local Docker network.

Introducing Wazuh LLM: Why Specialized Security Analysis Matters

In the cybersecurity world, SOC specialists deal with massive streams of security events daily. Analyzing each alert requires deep knowledge, experience, and time. That’s why I created a specialized language model to assist security analysts in their day-to-day operations.

Continuing the Series: Integrating a Wazuh Cluster with Ollama - Part 4. Configuration and Implementation

Related: Check out our Wazuh LLM fine-tuned model for specialized security event analysis.

Wazuh and Ollama: Part 3. Creating Integration Between Your Wazuh Cluster and Ollama

Wazuh offers vast and nearly limitless possibilities for integration with various systems. Even if a specific feature is missing, you can always create your own custom integration.

Wazuh and Ollama: Part 2. Deploying the Wazuh Cluster

Now it’s time to set up Wazuh, which we will integrate with Ollama.

Introduction

Welcome to the first part of our guide on enhancing Wazuh with Ollama!

Professional Summary

Senior Site Reliability Engineer with 14+ years building, scaling, and maintaining critical infrastructure across diverse technology environments.