This blog demonstrates how Wazuh can detect behaviors associated with this attack on Windows endpoints using Sysmon process creation logs.

A practical, production-ready guide to ensuring the reliability of your security monitoring platform

Real-time Threat Intelligence on Data Breaches

With Wazuh MCP Server, an analyst can ask: ‘What are the critical vulnerabilities on the production server?’ and receive a complete response in seconds, with live data directly from Wazuh.

In this video, I demonstrate how to install the Wazuh central components (Server, Indexer, and Dashboard) using a single command, following the official Wazuh Quick Start documentation.

This post is a technical deep-dive. Because Wazuh is the engine doing most of the heavy lifting, I want to be explicit up front about what’s native Wazuh and what this chart adds on top — that boundary matters if you’re trying to understand which parts you’d get out of the box versus what the chart contributes.

This blog covers both. What each system does, where it stores data, how to configure it correctly, and how to verify it’s actually working. All configuration is from the official Wazuh documentation.