A real-world example of what Wazuh makes possible: a UK-based work-experience program built entirely on the platform gives interns hands-on experience investigating genuine attacks, from honeypot sessions to live network intrusions, instead of simulated scenarios. Combining honeypots, IDS, endpoint telemetry, and WAF data with over 100 custom detection rules mapped to MITRE ATT&CK, the setup generated more than 23,000 real alerts in its first 30 days, all without licensing costs.

This article demonstrates how to integrate Centreon monitoring events into the Wazuh security platform by exporting Centreon Broker events as structured JSON via a Lua output module. A Wazuh agent then collects these events and forwards them to the Wazuh manager for storage, search, and correlation. The goal is to unify infrastructure monitoring and security telemetry without replacing either tool. This architecture enables richer incident context by combining service/host health data with security alerts. The key benefit is improved visibility and faster root-cause analysis through cross-domain event correlation.

Testing of Wazuh 5.0.0-beta5 validated a full Microsoft 365 / Microsoft Graph telemetry pipeline: from API collection through ECS normalization, indexing, and Sigma-based detection — on an all-in-one Manager, Indexer, and Dashboard deployment. Two beta-stage findings surfaced…

AI-Augmented Wazuh Operations: a 5-part series on validating AI-drafted rules, security-ops governance, and where human judgment must stay in the loop.

A Proof of Concept for AI-assisted SOC operations, built entirely on AWS with zero external AI API costs.

In this integration, we configure a Wazuh manager to enrich File Integrity Monitoring events with malware verdicts
from Hybrid Analysis. When a Wazuh agent detects a new or modified file, the manager submits the file’s SHA-256
hash to the Hybrid Analysis API, retrieves the community verdict, and generates a graduated alert on the Wazuh
dashboard. The manager submits a hash only, never the file itself. The integration therefore queries existing reports and does
not submit files for detonation. A file that Hybrid Analysis has never analyzed returns not_found. This integration was validated on a Wazuh 4.9.x manager against the Hybrid Analysis API v2. It requires a Hybrid Analysis API key, available from a free account at hybrid-analysis.com

A hands-on comparison of Wazuh 4.14.7 and 5.0 Beta 5: measured outage behavior, the new events/findings data model, rewritten agent transport, and why moving to 5.0 means rebuilding rules, dashboards, and runbooks — not just upgrading a version number.