AI-Augmented Wazuh Operations: a 5-part series on validating AI-drafted rules, security-ops governance, and where human judgment must stay in the loop.

A Proof of Concept for AI-assisted SOC operations, built entirely on AWS with zero external AI API costs.

In this integration, we configure a Wazuh manager to enrich File Integrity Monitoring events with malware verdicts
from Hybrid Analysis. When a Wazuh agent detects a new or modified file, the manager submits the file’s SHA-256
hash to the Hybrid Analysis API, retrieves the community verdict, and generates a graduated alert on the Wazuh
dashboard. The manager submits a hash only, never the file itself. The integration therefore queries existing reports and does
not submit files for detonation. A file that Hybrid Analysis has never analyzed returns not_found. This integration was validated on a Wazuh 4.9.x manager against the Hybrid Analysis API v2. It requires a Hybrid Analysis API key, available from a free account at hybrid-analysis.com

A hands-on comparison of Wazuh 4.14.7 and 5.0 Beta 5: measured outage behavior, the new events/findings data model, rewritten agent transport, and why moving to 5.0 means rebuilding rules, dashboards, and runbooks — not just upgrading a version number.

Part 3 of the Wazuh + AWS Bedrock series: build a 7,118-chunk k-NN index over MITRE ATT&CK, the Wazuh manual, SOC playbooks, and MISP events using Titan Embeddings V2 — with hybrid retrieval, a playbook read-through tool, and real failure cases.

In this guide, I’ll show how to use Wazuh’s native capabilities to generate email notifications only when specific server agents disconnect. By creating a custom rule that raises the alert level to 15, the event is automatically escalated through Wazuh’s built-in SMTP email integration, without relying on external scripts or third-party automation. This approach provides a simple, reliable, and fully native way to notify administrators whenever a critical server becomes unavailable.

Testing regex changes against a Wazuh manager for every edit gets old fast. wazuhregex is an open-source CLI and Python tool that tests and compares OS_Regex, OS_Match, and PCRE2 behavior locally, built for the remaining Wazuh 4.x lifecycle.

Learn how to build a Wazuh and Pulsedive integration from scratch to enrich security alerts with actionable threat intelligence. This integration helps SOC analysts automate threat enrichment, add context to indicators, and accelerate security investigations.

This post demonstrates an approach to advanced threat hunting using Wazuh telemetry. It shows how analysts can begin with detections in wazuh-alerts-*, investigate additional telemetry in wazuh-archives-*, and correlate Windows process information to reconstruct suspicious activity. The post demonstrates this approach using PowerShell execution, post-exploitation reconnaissance, named-pipe activity, and ClickFix-related clipboard activity.