Wazuh and AI: how to fine-tune a SOC without blowing the budget

Artificial intelligence has stopped being a laboratory experiment and become an everyday fixture in many organizations. It is used to automate repetitive tasks, find patterns in volumes of data that no person would review by hand, and speed up decisions. Cybersecurity is no exception: attackers also take advantage of these tools to automate their work, and defensive teams need to respond at the same speed.

In that context, The Hacker News publishes an analysis on how to combine Wazuh, an open detection and response platform, with AI capabilities to improve the workflows of a SOC (security operations center). The underlying idea is not to replace the analyst, but to take the most mechanical part of the day-to-day work off their hands.

What AI brings to a platform like Wazuh

Wazuh collects events from endpoints, servers, and cloud services, applies detection rules, and generates alerts. The classic problem is volume: a small SOC can receive hundreds or thousands of alerts per day, many of them repetitive or low-risk. That is where AI fits naturally.

• Assisted triage: classify and prioritize alerts based on context, instead of handling them in order of arrival.
• Correlation: relate events that, seen separately, seem harmless and together describe an intrusion.
• Summarization: turn an incident with dozens of lines of log into a comprehensible paragraph for whoever has to decide.
• Response automation: trigger bounded actions when the pattern is clear and the risk of false positives is low.

None of these capabilities is magic. All of them depend on the platform having clean data, well-maintained rules, and a clear policy on what can be automated and what must always go through a person.

Why this matters to an SME

The discourse on AI in security usually comes from large corporations with teams of dozens of people. The reality of a Seville-based SME or a professional firm is different: an IT manager who does everything, an external provider that handles incidents, and the permanent feeling that there are not enough hands. Precisely for that reason, an AI-assisted SOC has more relative value in a small organization than in a large one.

There are three practical effects worth keeping in mind:

1. Less noise, more focus. If the tool filters and sorts, the technician devotes their time to what could truly be an incident.
2. Faster response. The window between detection and containment is shortened, and in ransomware that marks the difference between a scare and a disaster.
3. Controlled cost. Wazuh is open-source software, which makes it possible to set up a monitoring base without expensive licenses. Spending shifts to design, integration, and maintenance, which is where the real effort lies.

It is worth not confusing this with an uncontrolled generative AI deployment. We have already seen how poorly integrated AI opens new fronts, as in the case of PHP2Shell and automated AI attacks. Adding a model to a SOC without reviewing permissions, without limiting what data is sent, and without validating its outputs is trading one problem for another.

Recommendations before getting started

At ForgeNEX we propose a phased approach, designed for small teams that cannot afford a six-month project without visible results:

• Start with visibility. Before talking about AI, make sure the logs from critical servers, endpoints, and cloud services reach Wazuh. Without data, no model can help.
• Organize the rules. Review the active detections and disable those that only generate noise. A SOC with fewer but better alerts is more useful than a saturated one.
• Define the scope of automation. Document which actions the system can execute on its own (for example, isolating a machine) and which require human approval.
• Measure before and after. Record the average triage time and the number of false positives. Without metrics, you will not know whether AI contributes or merely decorates.
• Take care of privacy. If you send events to an external model, review what personal or confidential information leaves your infrastructure and under what contractual conditions.

It is also worth reading the warnings about how AI is exposing old flaws that had been hidden for decades, as we covered in Altman's warning about 50-year-old flaws. The same capability that helps detect also accelerates the discovery of vulnerabilities, and that makes it necessary to keep the systems base up to date.

The role of the human factor

An AI-assisted SOC does not eliminate the need for judgment. The tool can say that a process is suspicious, but deciding whether it is a legitimate update or an attack requires business context: which servers are critical, which schedules are normal, who has access to what. That knowledge is not in the model; it is in the team.

AI does not replace the analyst: it gives them back time to think. And in a small team, that time is the scarcest resource.

The practical conclusion is simple: Wazuh with AI is not a silver bullet, but it is a reasonable path for an SME to gain visibility and response capability without multiplying its budget. Success depends less on the chosen tool and more on the discipline with which it is implemented.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.