Wazuh 4.14.7 ships with 14 system changes across cluster, API, FIM, and cloud layers — including two silent eBPF FIM bugs that caused undetected data loss on Amazon Linux, now resolved. The release also hardens cluster sync, restores cross-account AWS SQS ingestion, and fully removes the legacy wazuh-dbd daemon. Upgrade recommended for affected deployments.
Check if Wazuh’s decoders still match current vendor log formats and found eight of nine integrations had a real gap, with SentinelOne the exception. A newer beta release fixed some issues — the decoder catalog grew from ~140 to ~340 entries, with Cisco Meraki and FTD genuinely fixed, but AWS and Azure unchanged. A second batch of ten more vendors found nine still had uncovered changes, with Cortex XDR the worst gap.
Learn how Wazuh decoders transform raw security logs into structured data that rules can analyze effectively. This practical guide explains the complete log analysis pipeline, clarifies the difference between prematch and regex, and walks through creating clean custom decoders using the Parent-Child pattern. It also covers best practices and testing custom decoders with wazuh-logtest.
Discover how to integrate managed WordPress security telemetry into Wazuh without installing a Wazuh agent on the hosting platform. This practical guide presents an agentless architecture using a restricted SSH account, rsync, and an external Wazuh collector to securely pull Guardian Gaze logs from a managed, containerized environment. It covers the architecture, implementation, JSON log processing, detection rules, validation, troubleshooting, and operational considerations for building a reusable managed WordPress-to-Wazuh SIEM integration.
Learn how to monitor Linux scheduled tasks with Wazuh File Integrity Monitoring (FIM) and detect potential persistence through cron job changes. This practical, enterprise-focused guide covers centralized FIM configuration, monitoring critical Cron files across Debian/Ubuntu, RHEL, and SUSE environments, validating detections through security simulations, and investigating alerts in the Wazuh Dashboard.
Learn how to deregister a Wazuh agent from the manager using the manage_agents utility. This step-by-step guide explains how to identify and remove an agent from the manager while clarifying the difference between deregistering an agent and uninstalling its software from the endpoint.
An executive perspective for CISOs, CIOs and risk leaders navigating digital transformation in emerging markets.
In this walkthrough, I connect an AWS EC2 Ubuntu instance to a Wazuh manager running locally on Kali Linux using Docker.