This article shows how such load peaks can be reduced using HAProxy, what options Wazuh itself offers, and how to correctly interpret warning messages after a cluster upgrade.
A branded Wazuh dashboard can give a security team a consistent workspace and make exported reports easier to identify. In this article, we update the application, health check and report logos, then customize the dashboard title, login background and browser favicon.
Repeated password guesses against RDP can become a way into the network. Here, Wazuh correlates failed Windows logons from one IP and triggers Active Response to block it, with detection and blocking verified separately.
A security alert is the beginning of an investigation. Analysts still need to review its context, decide whether it belongs in a case and assign responsibility for the investigation. This walkthrough connects Wazuh detection to DFIR IRIS case management through an n8n workflow.
Application logs show very little when PHP itself is the weak point. Here, the PHP2Shell signals become Wazuh rules, decoders and an SCA policy, plus a reminder: check the package revision, not php -v, to know if a host is patched.
Six Wazuh rules, one safe test script, and a clear case for behavioral detection. Learn how to spot SharePoint ToolShell exploitation with Wazuh and Sysmon.
An alert can be technically complete and still impossible to triage. In part 4 of the AI-Augmented Wazuh Operations series, an enrichment pipeline was built. An orchestrator pulls context from threat intel, the CMDB, the directory and the Wazuh indexer. A model correlates it into a brief. The analyst still makes the final call.
Zero undocumented deviations beats a higher compliance score. Learn how wazuhscatune turns Wazuh SCA tailoring into a loosening guide that others can review.