Wazuh Outlines AI Options for SOC Reporting and Threat Hunting
Summary
Wazuh describes its AI Analyst for scheduled security reports and integrations using local or cloud-hosted models for SOC workflows. It says analysts should validate AI recommendations and outlines privacy and deployment options.
Key points
- Wazuh says its Cloud AI Analyst uses Amazon Bedrock and Anthropic’s Claude to generate scheduled reports covering security indicators, endpoint coverage, alert volume, active vulnerabilities, and security posture.
- Wazuh states that subscription data is not shared with third parties or used to train models, and is encrypted in transit, processed in isolation, and not permanently stored.
- A self-hosted option runs Meta’s Llama locally via Ollama; a Python script processes archived logs into a FAISS store for a LangChain chatbot. Wazuh says this option sends no data to a cloud provider.
- Another described integration connects Claude 3.5 Haiku on Amazon Bedrock to the Wazuh dashboard through OpenSearch Assistant, using OpenSearch plugins and an ML Commons connector, model, and agent.
- The article presents AI as support for alert analysis, investigation, and response, with analysts responsible for validating recommendations and consequential decisions.
Article Details
- Topic
- Using AI integrations and automated reporting to support security operations workflows.
Vendors
Amazonsecurity analysis service for Wazuh Cloud subscriptions that processes your security data through Amazon Bedrock and Anthropic’s Claude, delivering insights without any manual configuration. It periodicallyAnthropicservice for Wazuh Cloud subscriptions that processes your security data through Amazon Bedrock and Anthropic’s Claude, delivering insights without any manual configuration. It periodically emails key indicators, aMetaThis integration keeps everything on your own network. Ollama runs the Meta open-source Llama LLM locally on the Wazuh server; a Python script decompresses the archived logs for a chosen period, vectorizes them into aWazuhWazuh and artificial intelligence for enhanced SOC workflows
Products
Amazon Bedrocksecurity analysis service for Wazuh Cloud subscriptions that processes your security data through Amazon Bedrock and Anthropic’s Claude, delivering insights without any manual configuration. It periodically emailsClaude 3.5 HaikuThis integration surfaces Anthropic’s Claude 3.5 Haiku, hosted on Amazon Bedrock, as a chat box inside the dashboard through the OpenSearch Assistant. Setup involves enabling the model in Bedrock, installing theLlamaThis integration keeps everything on your own network. Ollama runs the Meta open-source Llama LLM locally on the Wazuh server; a Python script decompresses the archived logs for a chosen period, vectorizes them into aOllamaThis integration keeps everything on your own network. Ollama runs the Meta open-source Llama LLM locally on the Wazuh server; a Python script decompresses the archived logs for a chosen period, vectorizes them into aOpenSearch AssistantClaude 3.5 Haiku, hosted on Amazon Bedrock, as a chat box inside the dashboard through the OpenSearch Assistant. Setup involves enabling the model in Bedrock, installing the relevant OpenSearch plugins, andWazuh AI AnalystWazuh promotes flexible AI adoption through the Wazuh AI Analyst available on the Wazuh Cloud and integrations with third-party AI providers. Organizations can leverage the Wazuh AI Analyst capability on the Wazuh CloudWazuh CloudWazuh promotes flexible AI adoption through the Wazuh AI Analyst available on the Wazuh Cloud and integrations with third-party AI providers. Organizations can leverage the Wazuh AI Analyst capability on the Wazuh Cloud