"The Wazuh AI Analyst is automated and hands-off," Wazuh says — a short sentence that foregrounds a larger choice for modern security operations: embrace scheduled, AI-generated analysis from a managed cloud service, or assemble AI-assisted workflows inside your own network. The company describes both paths in detail, promising either turnkey reports for cloud subscribers or on-premises integrations built around Llama 3, Ollama, and Anthropic’s Claude model on Amazon Bedrock.
Challenges facing modern SOCs
Wazuh frames the problem plainly: Security Operations Centers (SOCs) "process millions of security events every day" and face "high alert volumes" that drive analyst fatigue and increase the odds that critical events are missed. Investigations, the source notes, commonly require switching across multiple dashboards, documentation repositories, vulnerability databases, and threat feeds before a coherent picture appears. As environments spread across on-premises and cloud workloads, maintaining consistent situational awareness becomes harder — and those are precisely the gaps Wazuh says AI can help close by reducing repetitive analysis, adding context, and accelerating investigative decision-making.
The Wazuh AI Analyst: automated reports and privacy controls
For organizations that subscribe to Wazuh Cloud, the Wazuh AI Analyst is presented as an automated, hands-off service that "processes your security data through Amazon Bedrock and Anthropic’s Claude," producing periodically scheduled reports. The output includes "key indicators, a histogram of protected endpoints, alert volume, active vulnerabilities, and a posture summary with a full PDF report attached," and the reports are delivered to the subscription’s registered email address and viewable in the Wazuh Cloud console under Environments > AI Reports.
Wazuh also articulates concrete privacy constraints for the cloud feature: "subscription data is not shared with third parties and is not used to train AI models; it is processed only to generate your reports, with encrypted transmission, isolated processing, and no permanent storage." The company explicitly frames AI-generated recommendations as advisory, advising that outputs "should be validated against your own policies before you act."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildSelf-hosted Llama 3 and Ollama: keeping data on-premises
For teams with strict privacy or data-residency needs, Wazuh documents a self-hosted path. That approach uses Ollama to run the Meta open-source Llama LLM locally on the Wazuh server. The documented workflow decompresses archived logs for a selected period with a Python script, vectorizes them into a FAISS store, and serves a LangChain-powered chatbot that analysts can query. Wazuh notes that "nothing is sent to a cloud provider," presenting this configuration as a way to retain data control while adding conversational, LLM-backed threat-hunting capabilities.
Anthropic’s Claude 3.5 Haiku on Amazon Bedrock via OpenSearch Assistant
Wazuh also describes an externally managed integration that surfaces "Anthropic’s Claude 3.5 Haiku, hosted on Amazon Bedrock," inside the Wazuh dashboard using the OpenSearch Assistant. Setup steps outlined by Wazuh include enabling the model in Bedrock, installing the relevant OpenSearch plugins, and creating an ML Commons connector, model, and conversational agent. Wazuh positions the assistant as a practical aid that can "provide useful guidance on many common tasks, including what to do about a finding and how to configure certain settings."
How technologists, procurement leaders, and privacy-sensitive teams will respond
- Technologists and security teams: They gain two explicit paths — a managed, scheduled-reporting service on Wazuh Cloud that leverages Bedrock and Claude, or a self-hosted stack built around Llama 3 and Ollama that keeps telemetry in-house. Either route is designed to reduce repetitive analysis and accelerate triage while leaving validation and consequential decisions to human analysts.
- Procurement and operations leaders: The Wazuh documentation surfaces different operational trade-offs — convenience and scheduled insights from a cloud subscription versus on-premises control and data residency with a self-hosted LLM. In procurement terms, the decision is framed as one between receiving automated, periodic reports and investing in internal integration work (Python scripts, FAISS stores, LangChain connectors).
- Privacy-sensitive teams: Wazuh provides an explicit on-premises recipe and asserts that the cloud reports are processed "with encrypted transmission, isolated processing, and no permanent storage," while promising that subscription data "is not used to train AI models." Those assurances are built into the vendor’s recommended architectures for teams worried about external model training and data leaks.
Wazuh’s documentation presents a pragmatic design: AI to augment analysts, not replace them. The company offers managed, scheduled analysis for cloud subscribers while also documenting a do-it-yourself stack for teams that must keep data inside their network. In both cases, Wazuh stresses that AI outputs are advisory and that validation against organizational policies remains the analyst’s responsibility — a final, practical caveat in a landscape where automation and human judgment must coexist.
