A Proof of Concept for AI-assisted SOC operations, built entirely on AWS with zero external AI API costs.

In this integration, we configure a Wazuh manager to enrich File Integrity Monitoring events with malware verdicts
from Hybrid Analysis. When a Wazuh agent detects a new or modified file, the manager submits the file’s SHA-256
hash to the Hybrid Analysis API, retrieves the community verdict, and generates a graduated alert on the Wazuh
dashboard. The manager submits a hash only, never the file itself. The integration therefore queries existing reports and does
not submit files for detonation. A file that Hybrid Analysis has never analyzed returns not_found. This integration was validated on a Wazuh 4.9.x manager against the Hybrid Analysis API v2. It requires a Hybrid Analysis API key, available from a free account at hybrid-analysis.com

A hands-on comparison of Wazuh 4.14.7 and 5.0 Beta 5: measured outage behavior, the new events/findings data model, rewritten agent transport, and why moving to 5.0 means rebuilding rules, dashboards, and runbooks — not just upgrading a version number.

Part 3 of the Wazuh + AWS Bedrock series: build a 7,118-chunk k-NN index over MITRE ATT&CK, the Wazuh manual, SOC playbooks, and MISP events using Titan Embeddings V2 — with hybrid retrieval, a playbook read-through tool, and real failure cases.

In this guide, I’ll show how to use Wazuh’s native capabilities to generate email notifications only when specific server agents disconnect. By creating a custom rule that raises the alert level to 15, the event is automatically escalated through Wazuh’s built-in SMTP email integration, without relying on external scripts or third-party automation. This approach provides a simple, reliable, and fully native way to notify administrators whenever a critical server becomes unavailable.

Testing regex changes against a Wazuh manager for every edit gets old fast. wazuhregex is an open-source CLI and Python tool that tests and compares OS_Regex, OS_Match, and PCRE2 behavior locally, built for the remaining Wazuh 4.x lifecycle.

Learn how to build a Wazuh and Pulsedive integration from scratch to enrich security alerts with actionable threat intelligence. This integration helps SOC analysts automate threat enrichment, add context to indicators, and accelerate security investigations.