AI Enhances SOC Workflows With Automated Threat Analysis

"The Wazuh AI Analyst is automated and hands-off."

The Wazuh AI Analyst: scheduled reports that summarize posture

Wazuh offers an AI-powered reporting capability for customers on Wazuh Cloud called the Wazuh AI Analyst. According to the product description, it "processes your security data through Amazon Bedrock and Anthropic’s Claude" and delivers periodic, automated summaries by email and via the Wazuh Cloud console. Each report includes key indicators: a histogram of protected endpoints, alert volume, active vulnerabilities, and an overall posture summary, with a full PDF report attached.

Reports are generated on the subscription’s schedule and are sent to the registered email address or can be reviewed inside the console at Environments > AI Reports. Wazuh states the service is "automated and hands-off," designed to surface patterns and posture over time without manual configuration.

Privacy controls and advisory output

Wazuh draws a clear line around data handling for the AI Analyst: subscription data "is not shared with third parties and is not used to train AI models;" it is processed only to generate the reports. Wazuh describes processing as occurring with encrypted transmission, isolated processing, and "no permanent storage." The company also frames the Analyst’s recommendations as advisory: "As with any AI output, the recommendations are advisory and should be validated against your own policies before you act."

Self-hosted Llama 3 with Ollama: local threat hunting

For teams that require on-premises control, Wazuh documents an integration that uses Ollama to run the Meta open source Llama LLM locally on the Wazuh server. The described workflow uses a Python script to decompress archived logs for a chosen period, vectorize them into a FAISS store, and serve a LangChain-powered chatbot that analysts can query.

Wazuh emphasizes that "nothing is sent to a cloud provider" in this configuration, positioning the integration as "well-suited to teams with strict privacy or data-residency requirements." Full setup instructions are available in the Wazuh blog post titled "Leveraging artificial intelligence for threat hunting in Wazuh."

Claude 3.5 Haiku on Amazon Bedrock: an assistant inside the dashboard

An alternative path uses externally managed cloud models. Wazuh describes surfacing Anthropic’s Claude 3.5 Haiku, hosted on Amazon Bedrock, as a chat box inside the Wazuh dashboard via the OpenSearch Assistant. Implementing that assistant requires enabling the model in Bedrock, installing the relevant OpenSearch plugins, and creating an ML Commons connector, model, and conversational agent.

Wazuh says the assistant can "provide useful guidance on many common tasks, including what to do about a finding and how to configure certain settings." Detailed setup steps are provided in the Wazuh blog post "Leveraging Claude Haiku in the Wazuh dashboard for LLM-powered insights."

What this means for security teams, Wazuh Cloud users, and privacy-conscious operators

• Security teams and technologists: The Wazuh AI Analyst is positioned to reduce repetitive triage work by delivering periodic summaries and curated indicators, but teams must treat AI recommendations as advisory and validate them against internal policies.
• Wazuh Cloud subscribers: They can receive scheduled reports by email and access them via Environments > AI Reports. The Cloud path uses Amazon Bedrock and Anthropic’s Claude to generate insights without manual configuration.
• Privacy-conscious or data-residency-focused operators: Wazuh documents an on-premises workflow using Ollama with Llama 3 and a FAISS vector store so that "nothing is sent to a cloud provider," explicitly addressing strict privacy requirements.

Wazuh’s materials frame AI as an augmentation, not a replacement: the technology is described as a way to "reduce repetitive work, accelerate investigations, and provide contextual support for detection, triage, and response activities," while leaving consequential decisions and validation to human analysts. For organizations weighing cloud-hosted convenience against on-premises control, Wazuh presents both paths with concrete setup instructions and explicit data-handling claims. Those considering adoption will find detailed step-by-step guidance in the referenced Wazuh blog posts and the Environments > AI Reports page for Cloud subscribers.

Original story: https://thehackernews.com/2026/08/wazuh-and-ai-for-enhanced-soc-workflows.html