Wazuh + AWS Bedrock: S3 Vectors for SOC Knowledge (Part 4)

 Posted on October 6, 2026  |  14 minutes  |  2980 words  |  pyToshka  • Other languages: Русский

Moving the knowledge corpus out of the Indexer

Part 3 ended with a condition, not a recommendation: the vector index belongs inside the Wazuh Indexer while the corpus is small and the clients already speak OpenSearch, and belongs somewhere else when the vector engine matters, when the corpus outgrows a single node, or when alert ingestion already claims that node’s CPU and heap. This part tests the other side of that condition. The same four sources went into Amazon S3 Vectors through an Amazon Bedrock Knowledge Base, the in-Indexer branch was rebuilt from the same snapshot so both could be measured on the same day, and the same frozen questions ran against both.

[Read More]
devsecops  wazuh  security  aws  s3  bedrock  llm  ai  rag  embeddings  vector search  knowledge base  cybersecurity  threat intelligence  security operations  cloud security  mcp  opensearch 

Wazuh + AWS Bedrock: RAG with Titan Embeddings (Part 3)

 Posted on September 5, 2026  (Last modified on October 6, 2026)  |  33 minutes  |  6921 words  |  pyToshka  • Other languages: Русский

Introduction

Ask the chat agent from Part 1 what the team runbook prescribes for an SSH brute force against web-server-01, or ask the MCP sidecar from Part 2 whether a file hash appeared in a threat intelligence feed last month, and the answer is whatever Claude remembers about the world in general. Both tools query alerts well. Neither of them can read a document, and the runbook, the manual and the feed never reach the model.

[Read More]
devsecops  wazuh  security  aws  docker  llm  ai  machine learning  cybersecurity  automation  threat intelligence  security operations  cloud security  mcp  rag  embeddings  opensearch  mitre  misp 

Wazuh + AWS Bedrock: AI Security in Docker (Part 1)

 Posted on March 16, 2026  (Last modified on October 6, 2026)  |  8 minutes  |  1550 words  |  pyToshka  • Other languages: Русский

Introduction

In the previous article we embedded a local Ollama model directly into the Wazuh Dashboard chat via ML Commons. That approach provides full control over data with no cloud dependencies. In this series we take a parallel path: using AWS Bedrock - specifically Claude Sonnet 4.5 - as the inference backend, while all security data stays strictly within the local Docker network.

[Read More]
devsecops  wazuh  security  aws  docker  llm  ai  machine learning  cybersecurity  automation  monitoring  threat intelligence  security operations  cloud security  mcp 

Wazuh LLM: Fine-Tuned Llama 3.1 for Security Analysis

 Posted on October 2, 2025  (Last modified on March 23, 2026)  |  9 minutes  |  1916 words  |  pyToshka  • Other languages: Русский

Introducing Wazuh LLM: Why Specialized Security Analysis Matters

In the cybersecurity world, SOC specialists deal with massive streams of security events daily. Analyzing each alert requires deep knowledge, experience, and time. That’s why I created a specialized language model to assist security analysts in their day-to-day operations.

[Read More]
devsecops  wazuh  security  research  devops  llm  ollama  machine learning  cybersecurity  automation  monitoring  incident response  threat intelligence  security operations  log analysis  ai  fine-tuning  MITRE ATT&CK 

Building ML Threat Intelligence with Honeypot Data

 Posted on September 24, 2025  (Last modified on March 23, 2026)  |  10 minutes  |  2034 words  |  pyToshka  • Other languages: Русский

Introduction

Picture this: you’re staring at security logs with thousands of events streaming in daily. Which ones are actually dangerous? Which can you safely ignore? Traditional signature-based detection is like playing whack-a-mole with cybercriminals - they’ve gotten really good at dodging known signatures faster than we can create them.

[Read More]
machine learning  cybersecurity  honeypot  threat intelligence  datasets  hugging face  anomaly detection  network security  attack classification  security analytics  devsecops  feature engineering  threat hunting 

Enhancing Wazuh with Ollama: Cybersecurity Boost (Part 4)

 Posted on March 1, 2025  (Last modified on March 23, 2026)  |  7 minutes  |  1351 words  |  pyToshka  • Other languages: Русский

Continuing the Series: Integrating a Wazuh Cluster with Ollama - Part 4. Configuration and Implementation

Related: Check out our Wazuh LLM fine-tuned model for specialized security event analysis.

[Read More]
devsecops  wazuh  security  research  devops  llm  ollama  machine learning  cybersecurity  automation  monitoring  incident response  threat intelligence  security operations  log analysis  ai 

Enhancing Wazuh with Ollama: Cybersecurity Boost (Part 3)

 Posted on February 27, 2025  (Last modified on March 23, 2026)  |  5 minutes  |  856 words  |  pyToshka  • Other languages: Русский

Wazuh and Ollama: Part 3. Creating Integration Between Your Wazuh Cluster and Ollama

Wazuh offers vast and nearly limitless possibilities for integration with various systems. Even if a specific feature is missing, you can always create your own custom integration.

[Read More]
devsecops  wazuh  security  research  devops  llm  ollama  machine learning  cybersecurity  automation  monitoring  incident response  threat intelligence  security operations  log analysis  ai 

Enhancing Wazuh with Ollama: Cybersecurity Boost (Part 2)

 Posted on February 26, 2025  (Last modified on February 2, 2026)  |  6 minutes  |  1151 words  |  pyToshka  • Other languages: Русский

Wazuh and Ollama: Part 2. Deploying the Wazuh Cluster

Now it’s time to set up Wazuh, which we will integrate with Ollama.

[Read More]
devsecops  wazuh  security  research  devops  llm  ollama  machine learning  cybersecurity  automation  monitoring  incident response  threat intelligence  security operations  log analysis  ai 

Enhancing Wazuh with Ollama: Cybersecurity Boost (Part 1)

 Posted on February 24, 2025  (Last modified on February 2, 2026)  |  5 minutes  |  875 words  |  pyToshka  • Other languages: Русский

Introduction

Welcome to the first part of our guide on enhancing Wazuh with Ollama!

[Read More]
devsecops  wazuh  security  research  devops  llm  ollama  machine learning  cybersecurity  automation  monitoring  incident response  threat intelligence  security operations  log analysis  ai 

Mitigation Anomaly Revelation Keeper(MARK)

 Posted on December 4, 2024  (Last modified on February 2, 2026)  |  4 minutes  |  732 words  |  pyToshka  • Other languages: Русский

Overview

Mitigation Anomaly Revelation Keeper (MARK) is an advanced security platform designed to proactively defend against cyber threats by leveraging cutting-edge IP reputation analysis and machine learning. With a focus on identifying and neutralizing malicious actors, MARK offers unparalleled insight into attacker behavior and statistical trends to fortify your organization’s defenses.

[Read More]
devsecops  security  research  devops  ip reputation  malware analysis  incident response  threat intelligence  machine learning  automation  soc tools