Wazuh Integrates AI to Ease Security Operations Center Workloads

Artificial intelligence is becoming a standard tool in cybersecurity, and Wazuh is now offering ways for security teams to use it without overhauling their existing workflows. The company has introduced the Wazuh AI Analyst for its cloud platform, along with optional integrations for those running Wazuh on their own infrastructure. The goal is to cut down on repetitive tasks and help analysts focus on what matters most.

Modern security operations centers are flooded with alerts from endpoints, cloud workloads, network devices, and business applications. Analysts often spend a lot of time correlating data across multiple dashboards and documentation before they can act. High alert volumes can lead to fatigue and missed critical events. Wazuh's approach uses AI to provide context, summarize findings, and suggest remediation steps, rather than replacing human judgment.

The Wazuh AI Analyst, available for Wazuh Cloud subscriptions, runs automatically. It processes security data through Amazon Bedrock and Anthropic's Claude, sending periodic email reports that include key indicators, a histogram of protected endpoints, alert volume, active vulnerabilities, and a posture summary with a full PDF attachment. Reports are also viewable in the Wazuh Cloud console under Environments > AI Reports. According to Wazuh, subscription data is not shared with third parties, is not used to train AI models, and is processed only to generate reports with encrypted transmission and no permanent storage. The recommendations are advisory and should be checked against an organization's own policies.

For those who self-host Wazuh, there are two integration options. One uses a self-hosted Llama 3 model via Ollama, keeping everything on the user's own network. A Python script decompresses archived logs, vectorizes them into a FAISS store, and powers a LangChain-based chatbot for querying. Nothing is sent to a cloud provider, making it suitable for strict privacy or data-residency requirements. The other option integrates Claude 3.5 Haiku, hosted on Amazon Bedrock, as a chat box inside the dashboard through the OpenSearch Assistant. Setup involves enabling the model in Bedrock, installing OpenSearch plugins, and creating an ML Commons connector, model, and conversational agent. This assistant can offer guidance on common tasks like handling a finding or configuring settings.

Wazuh positions these capabilities as support tools, not replacements for analysts. The company stresses that human oversight remains essential for validation and final decisions. For cloud users, the AI Analyst provides scheduled reports; for others, the self-hosted or externally managed integrations allow teams to align AI use with their operational, privacy, and data-residency needs. Full setup instructions are available in Wazuh's blog posts on threat hunting with AI and using Claude Haiku in the dashboard.