From an SSH attack to an enriched case: a detection and response pipeline built on Wazuh and Cortex (open source) and TheHive (free community licence), validated with real internet scanner traffic.
Anyone wanting to connect Windows endpoints to a SIEM like Wazuh quickly faces a simple question: How many events are on the system, and how large are the log files? Providing a PowerShell script just for such a query is cumbersome. In many customer environments, script execution is prohibited, and the script code is easily tampered with. Therefore, I developed win-eventstats as a small, standalone .exe file .
AI does not decide where the boundary sits between routine work and judgment. Accountability does. This closing article of the AI-Augmented Wazuh Operations series explains why some decisions must stay human, how to build accountability chains, and how the analyst role relocates rather than shrinks.
Learn how to forward Synology NAS logs to Wazuh using Syslog, configure centralized log collection, and visualize NAS activity through Wazuh dashboards.
Wazuh shows you what is vulnerable. This walkthrough follows one finding from detection to verified closure, including evidence, exceptions, and re-checks.
The CVE-2026-109618 and CVE-2026-109619 vulnerabilities demonstrate why web server security requires more than just patching applications: it needs to combine vulnerability management, monitoring, and behavioral detection.
This article shows how such load peaks can be reduced using HAProxy, what options Wazuh itself offers, and how to correctly interpret warning messages after a cluster upgrade.
A branded Wazuh dashboard can give a security team a consistent workspace and make exported reports easier to identify. In this article, we update the application, health check and report logos, then customize the dashboard title, login background and browser favicon.