Wazuh details AI-assisted SOC workflows via Wazuh AI Analyst and third-party LLM integrations
This vendor-sponsored article describes how Wazuh supports AI-assisted Security Operations Center (SOC) workflows. It presents the Wazuh AI Analyst, a Wazuh Cloud service that processes security data through Amazon Bedrock and Anthropic's Claude to produce scheduled posture reports. It also covers two integrations for self-deployed environments: a self-hosted Llama 3 and Ollama chatbot, and Claude 3.5 Haiku on Amazon Bedrock through the OpenSearch Assistant. The article describes no threat, vulnerability or incident. It is product and industry content.
Detalhes técnicos
- Wazuh AI Analyst: it needs no manual configuration. It emails key indicators, an endpoint histogram, alert volume, active vulnerabilities and a posture summary with a PDF report, and the reports are also available in the Wazuh Cloud console under Environments > AI Reports. According to the article, subscription data is not shared with third parties or used to train models, and there is no permanent storage.
- Self-hosted option: Ollama runs Meta's Llama locally on the Wazuh server. A Python script decompresses archived logs, vectorizes them into a FAISS store and serves a LangChain chatbot. Nothing is sent to a cloud provider.
- Managed option: Claude 3.5 Haiku on Amazon Bedrock appears as a chat box in the dashboard through the OpenSearch Assistant. Setup involves enabling the model in Bedrock, installing OpenSearch plugins and creating an ML Commons connector, model and conversational agent.
Remediação
No remediation applies. The article advises treating AI output as advisory and validating recommendations against organizational policies before acting.
Linha do tempo
-
Wazuh details AI-assisted SOC workflows via Wazuh AI Analyst and third-party LLM integrations
ler a análise desta fonte ocultar
This vendor-sponsored article describes how Wazuh supports AI-assisted Security Operations Center (SOC) workflows. It presents the Wazuh AI Analyst, a Wazuh Cloud service that processes security data through Amazon Bedrock and Anthropic's Claude to produce scheduled posture reports. It also covers two integrations for self-deployed environments: a self-hosted Llama 3 and Ollama chatbot, and Claude 3.5 Haiku on Amazon Bedrock through the OpenSearch Assistant. The article describes no threat, vulnerability or incident. It is product and industry content.
Technical Details
- Wazuh AI Analyst: it needs no manual configuration. It emails key indicators, an endpoint histogram, alert volume, active vulnerabilities and a posture summary with a PDF report, and the reports are also available in the Wazuh Cloud console under Environments > AI Reports. According to the article, subscription data is not shared with third parties or used to train models, and there is no permanent storage.
- Self-hosted option: Ollama runs Meta's Llama locally on the Wazuh server. A Python script decompresses archived logs, vectorizes them into a FAISS store and serves a LangChain chatbot. Nothing is sent to a cloud provider.
- Managed option: Claude 3.5 Haiku on Amazon Bedrock appears as a chat box in the dashboard through the OpenSearch Assistant. Setup involves enabling the model in Bedrock, installing OpenSearch plugins and creating an ML Commons connector, model and conversational agent.
Remediation
No remediation applies. The article advises treating AI output as advisory and validating recommendations against organizational policies before acting.