pyToshka's DevSecOps Blog

The first thing 5.0 broke for me was not a feature.

Introduction Ask the chat agent from Part 1 what the team runbook prescribes for an SSH brute force against web-server-01, or ask the MCP sidecar from Part 2 whether a file hash appeared in a threat intelligence feed last month, and the answer is whatever…

“Wazuh Static Analysis” series: Part 1: Decoders - decoder XML validation Part 2: Rules (you are here) - rule validation and cross-type checking In Part 1 we built a linter for Wazuh decoder XML files - a tool that validates structure, regex/order consist…

Introduction In Part 1 we connected AWS Bedrock Claude to the Wazuh Dashboard chat via ML Commons.

Introduction In the previous article we embedded a local Ollama model directly into the Wazuh Dashboard chat via ML Commons.

Introduction I’m excited to share that I’ve been accepted into the AWS Community Builders program for the 2026 cohort in the Security category.

“Wazuh Static Analysis” series: Part 1: Decoders (you are here) - decoder XML validation Part 2: Rules - rule validation and cross-type checking Wazuh decoder XML files define how raw log lines are parsed into structured security events.

Introduction Integrating local language models directly into the Wazuh interface opens fundamentally new capabilities for information security teams.

I’m excited to announce that I have officially joined the Wazuh Ambassador Program.

When Your SOC Analyst Can’t Keep Up (Or Just Needs a Break) Let’s be honest: analyzing thousands of security events every day isn’t the most exciting job.

Introducing Wazuh LLM: Why Specialized Security Analysis Matters In the cybersecurity world, SOC specialists deal with massive streams of security events daily.

Introduction Picture this: you’re staring at security logs with thousands of events streaming in daily.

Moving on, let’s look at the other controls for EKS SOC Type 2.

Introduction Navigating the world of compliance can feel like trying to read a map in a language you don’t speak.

This article draws inspiration from the Wazuh blog post on enhancing container image security with Wazuh and Trivy.

Related Reading: Wazuh Integration with Ollama Series - Learn how to integrate Wazuh with Ollama Wazuh LLM Security Event Analysis - Specialized model for Wazuh events Prerequisites and Environment Setup For local RAG development, ensure you have the foll…

Introduction to RAG Retrieval-Augmented Generation (RAG) is a method that allows the use of information from various sources to generate more accurate and useful responses to questions.

Continuing the Series: Integrating a Wazuh Cluster with Ollama - Part 4.

Wazuh and Ollama: Part 3.

Wazuh and Ollama: Part 2.

Introduction Welcome to the first part of our guide on enhancing Wazuh with Ollama!

Topic Clusters This page organizes our content into thematic clusters to improve navigation and SEO performance.

Introduction Integrating Wazuh SIEM with MARK (Mitigation Anomaly Revelation Keeper) enables automated threat detection and enriches security alerts with intelligence data.

Overview Mitigation Anomaly Revelation Keeper (MARK) is an advanced security platform designed to proactively defend against cyber threats by leveraging cutting-edge IP reputation analysis and machine learning.