In this use case, we install Docker Engine on the Ubuntu Server (where the Wazuh agent is already installed), configure the Wazuh agent to monitor Docker events, and verify that the alerts appear correctly on the Wazuh Dashboard.

This article walks through four of those blind spots, the “under the hood” tuning areas that are rarely discussed but make the difference between a Wazuh deployment that keeps up and one that falls behind.

From security detection to IOC enrichment, investigation, and automated notification using an open-source security stack.

In this blog post, we demonstrate how to configure MinIO as a self-hosted S3-compatible snapshot repository for the Wazuh indexer.

Explore how Wazuh leverages artificial intelligence to enhance SOC workflows, helping security teams reduce repetitive tasks, accelerate investigations, and gain actionable context for threat detection and response.

In this Live Demo, I’ll show you how to combine Wazuh FIM, YARA, Active Response and an LLM to create an automated malware detection and alert-enrichment workflow.

Wazuh 4.14.7 ships with 14 system changes across cluster, API, FIM, and cloud layers — including two silent eBPF FIM bugs that caused undetected data loss on Amazon Linux, now resolved. The release also hardens cluster sync, restores cross-account AWS SQS ingestion, and fully removes the legacy wazuh-dbd daemon. Upgrade recommended for affected deployments.