Recent content on pyToshka's DevSecOps Blog
“Wazuh Static Analysis” series: Part 1: Decoders - decoder XML validation Part 2: Rules (you are here) - rule validation and cross-type checking In Part 1 we built a linter for Wazuh decoder XML files - a tool that validates structure, regex/order consistency, and parent-child decoder chains. But decoders are only half of the event processing pipeline. Decoders extract fields from raw…
Introduction In Part 1 we connected AWS Bedrock Claude to the Wazuh Dashboard chat via ML Commons. That approach works well for analysts working inside the Wazuh UI. In this part we open a second channel: Model Context Protocol (MCP) , which allows any compatible client - Claude Desktop, custom applications, CI pipelines - to query Wazuh Indexer data through a standardized tool interface.
Introduction In the previous article we embedded a local Ollama model directly into the Wazuh Dashboard chat via ML Commons. That approach provides full control over data with no cloud dependencies. In this series we take a parallel path: using AWS Bedrock - specifically Claude Sonnet 4.5 - as the inference backend, while all security data stays strictly within the local Docker network.
Introduction I’m excited to share that I’ve been accepted into the AWS Community Builders program for the 2026 cohort in the Security category. For me, this is a natural next step after becoming a Wazuh Ambassador - another milestone in a journey that has always been centered around open-source security and cloud infrastructure.
“Wazuh Static Analysis” series: Part 1: Decoders (you are here) - decoder XML validation Part 2: Rules - rule validation and cross-type checking Wazuh decoder XML files define how raw log lines are parsed into structured security events. A misconfigured decoder – a missing <order> element, an orphaned parent reference, or a regex group mismatch – can silently drop critical…
Introduction Integrating local language models directly into the Wazuh interface opens fundamentally new capabilities for information security teams. Unlike cloud-based AI solutions, Ollama enables security event analysis entirely within an organization’s isolated infrastructure, eliminating the transmission of confidential data beyond the network perimeter. Embedding an AI assistant into…
I’m excited to announce that I have officially joined the Wazuh Ambassador Program . This is a significant milestone in my journey with open-source security, and I’m honored to represent and contribute to a platform that has become central to my professional work. My Journey with Wazuh My path with host-based intrusion detection started long before Wazuh existed – with OSSEC, its…
When Your SOC Analyst Can’t Keep Up (Or Just Needs a Break) Let’s be honest: analyzing thousands of security events every day isn’t the most exciting job.
Introducing Wazuh LLM: Why Specialized Security Analysis Matters In the cybersecurity world, SOC specialists deal with massive streams of security events daily. Analyzing each alert requires deep knowledge, experience, and time. That’s why I created a specialized language model to assist security analysts in their day-to-day operations.
Introduction Picture this: you’re staring at security logs with thousands of events streaming in daily. Which ones are actually dangerous? Which can you safely ignore? Traditional signature-based detection is like playing whack-a-mole with cybercriminals - they’ve gotten really good at dodging known signatures faster than we can create them.
Introduction Navigating the world of compliance can feel like trying to read a map in a language you don’t speak. When you throw Kubernetes into the mix, it gets even trickier. That’s why we’ve put together this straightforward, human-friendly checklist to help you get your Amazon EKS clusters ready for a SOC 2 Type II audit.
Moving on, let’s look at the other controls for EKS SOC Type 2. For container security best practices, see our guide on Container Image Security with Wazuh and Trivy . CC3: Risk Assessment EKS-Specific Risk Assessment Identify, evaluate, and document security, operational, and compliance risks specific to Amazon EKS clusters and workloads to ensure that appropriate controls are implemented,…
This article draws inspiration from the Wazuh blog post on enhancing container image security with Wazuh and Trivy. Containerization has revolutionized software development and deployment, offering scalability and efficiency. However, this agility can introduce security risks if container images aren’t properly secured. Vulnerabilities within these images can expose your entire system to…
Related Reading: Wazuh Integration with Ollama Series - Learn how to integrate Wazuh with Ollama Wazuh LLM Security Event Analysis - Specialized model for Wazuh events Prerequisites and Environment Setup For local RAG development, ensure you have the following requirements:
Introduction to RAG Retrieval-Augmented Generation ( RAG ) is a method that allows the use of information from various sources to generate more accurate and useful responses to questions.
Continuing the Series: Integrating a Wazuh Cluster with Ollama - Part 4. Configuration and Implementation Related: Check out our Wazuh LLM fine-tuned model for specialized security event analysis.
Wazuh and Ollama: Part 3. Creating Integration Between Your Wazuh Cluster and Ollama Wazuh offers vast and nearly limitless possibilities for integration with various systems. Even if a specific feature is missing, you can always create your own custom integration.
Wazuh and Ollama: Part 2. Deploying the Wazuh Cluster Now it’s time to set up Wazuh , which we will integrate with Ollama .
Introduction Welcome to the first part of our guide on enhancing Wazuh with Ollama !
Topic Clusters This page organizes our content into thematic clusters to improve navigation and SEO performance.
Introduction Integrating Wazuh SIEM with MARK (Mitigation Anomaly Revelation Keeper) enables automated threat detection and enriches security alerts with intelligence data. This guide walks you through setting up a custom integration for enhanced SOC operations.
Overview Mitigation Anomaly Revelation Keeper (MARK) is an advanced security platform designed to proactively defend against cyber threats by leveraging cutting-edge IP reputation analysis and machine learning. With a focus on identifying and neutralizing malicious actors, MARK offers unparalleled insight into attacker behavior and statistical trends to fortify your organization’s defenses.
Professional Summary Senior Site Reliability Engineer with 14+ years building, scaling, and maintaining critical infrastructure across diverse technology environments.