From an SSH attack to an enriched case: a detection and response pipeline built on Wazuh and Cortex (open source) and TheHive (free community licence), validated with real internet scanner traffic.
AI does not decide where the boundary sits between routine work and judgment. Accountability does. This closing article of the AI-Augmented Wazuh Operations series explains why some decisions must stay human, how to build accountability chains, and how the analyst role relocates rather than shrinks.
Learn how to forward Synology NAS logs to Wazuh using Syslog, configure centralized log collection, and visualize NAS activity through Wazuh dashboards.
Wazuh shows you what is vulnerable. This walkthrough follows one finding from detection to verified closure, including evidence, exceptions, and re-checks.
The CVE-2026-109618 and CVE-2026-109619 vulnerabilities demonstrate why web server security requires more than just patching applications: it needs to combine vulnerability management, monitoring, and behavioral detection.
This article shows how such load peaks can be reduced using HAProxy, what options Wazuh itself offers, and how to correctly interpret warning messages after a cluster upgrade.
A branded Wazuh dashboard can give a security team a consistent workspace and make exported reports easier to identify. In this article, we update the application, health check and report logos, then customize the dashboard title, login background and browser favicon.
Repeated password guesses against RDP can become a way into the network. Here, Wazuh correlates failed Windows logons from one IP and triggers Active Response to block it, with detection and blocking verified separately.