Wazuh and AI For Enhanced SOC Workflows

Summary

Wazuh is enhancing Security Operations Center (SOC) workflows by integrating Artificial Intelligence. The Wazuh AI Analyst, available on Wazuh Cloud, uses services like Amazon Bedrock and Anthropic's Claude to provide automated security posture summaries and recommendations. For self-hosted deployments, Wazuh supports integrations with external AI providers, including self-hosted LLMs like Meta's Llama 3 via Ollama, enabling advanced threat hunting and analysis without sending data to the cloud.

Full text

Wazuh and AI For Enhanced SOC Workflows The Hacker NewsAug 21, 2026Security Operations / Artificial Intelligence Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making. Cybersecurity has experienced a similar transformation. While attackers employ AI to automate cyberattacks and accelerate vulnerability discovery, defenders are adopting AI to improve threat detection and enhance incident response. Security Operations Centers (SOCs) receive a high volume of alerts from endpoints, cloud workloads, network devices, identity providers, and business applications. Although SIEM and XDR platforms provide visibility into these environments, analysts often spend considerable time correlating alerts, searching documentation, and determining the next investigative steps. AI offers a practical way to augment analysts by providing contextual explanations, summarizing findings, and recommending remediation actions, rather than replacing human expertise. Challenges facing modern SOCs Modern SOCs are expected to detect and respond to sophisticated threats while processing millions of security events every day. High alert volumes contribute to analyst fatigue and increase the likelihood that critical events are overlooked. Investigations frequently require switching between dashboards, documentation, vulnerability databases, and threat intelligence feeds before a complete picture emerges. As infrastructures become increasingly distributed across on-premises and cloud environments, maintaining consistent situational awareness becomes more difficult. AI-assisted workflows help address these challenges by reducing repetitive analysis, adding context, and accelerating investigative decision-making. Wazuh and artificial intelligence for enhanced SOC workflows Wazuh promotes flexible AI adoption through the Wazuh AI Analyst available on the Wazuh Cloud and integrations with third-party AI providers. Organizations can leverage the Wazuh AI Analyst capability on the Wazuh Cloud for guidance on their environment's security posture. Organizations that self-deploy Wazuh can also leverage Wazuh integrations with AI providers. The following sections highlight further details: The Wazuh AI Analyst The Wazuh AI Analyst is automated and hands-off. It is an AI-powered security analysis service for Wazuh Cloud subscriptions that processes your security data through Amazon Bedrock and Anthropic’s Claude, delivering insights without any manual configuration. It periodically emails key indicators, a histogram of protected endpoints, alert volume, active vulnerabilities, and a posture summary with a full PDF report attached. The reports are generated on your Wazuh Cloud subscription’s schedule and are periodically sent to your registered email address. You can also view them from the Wazuh Cloud console in the Environments > AI Reports page. On privacy, subscription data is not shared with third parties and is not used to train AI models; it is processed only to generate your reports, with encrypted transmission, isolated processing, and no permanent storage. As with any AI output, the recommendations are advisory and should be validated against your own policies before you act. Threat hunting and security operations with external AI integrations Beyond the Wazuh AI Analyst, you can expand Wazuh capabilities using a self-hosted LLM and externally managed AI integrations tailored to your needs. Self-hosted Llama 3 and Ollama This integration keeps everything on your own network. Ollama runs the Meta open source Llama LLM locally on the Wazuh server; a Python script decompresses the archived logs for a chosen period, vectorizes them into a FAISS store, and serves a LangChain-powered chatbot you can query. Nothing is sent to a cloud provider, which makes it well-suited to teams with strict privacy or data-residency requirements. Full setup steps are in the Wazuh blog post: Leveraging artificial intelligence for threat hunting in Wazuh. Externally managed integration with Claude 3.5 Haiku This integration surfaces Anthropic’s Claude 3.5 Haiku, hosted on Amazon Bedrock, as a chat box inside the dashboard through the OpenSearch Assistant. Setup involves enabling the model in Bedrock, installing the relevant OpenSearch plugins, and creating an ML Commons connector, model, and conversational agent. The assistant can provide useful guidance on many common tasks, including what to do about a finding and how to configure certain settings. Full setup steps are in the Wazuh blog post: Leveraging Claude Haiku in the Wazuh dashboard for LLM-powered insights. Conclusion Artificial intelligence is becoming an important capability in modern SOCs. Rather than replacing analysts, it can reduce repetitive work, accelerate investigations, and provide contextual support for detection, triage, and response activities. These capabilities can help security teams operate more efficiently while keeping analysts responsible for validation and consequential decisions. For Wazuh Cloud users, the Wazuh AI Analyst provides automated, scheduled security reports covering key indicators, alert activity, endpoint coverage, active vulnerabilities, and overall security posture. Organizations can further tailor AI-enabled security operations through self-hosted LLM integrations for privacy-sensitive threat hunting or externally managed, cloud-hosted models, aligning adoption with their operational, privacy, and data-residency requirements. Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  artificial intelligence, Cloud security, data privacy, Incident response, Security Operations, SIEM, Threat Detection, Threat Hunting, XDR ⚡ Top Stories This Week Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables 18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers ⭐ Featured Resources See How to Stop the Browser-Base

Entities