Nothing here is theoretical. The architectures, tuning numbers and tenancy design come from a production deployment serving multiple customers, with the customer details removed. Where the official documentation stops, this level continues.
Wazuh at Scale
Fourteen lessons drawn from running a multi-tenant Wazuh SOC in production. This is the level for SOC leads, MSSPs and the security leader deciding whether to build or buy.
- 01Wazuh Cluster and Distributed ArchitectureHow a Wazuh cluster is built in 5.0: manager master and workers, a multi-node indexer, agent traffic behind a load balancer, certificates and health checks.11 min read
- 02Wazuh Performance Tuning: EPS, Heap, Shards and QueuesFind the real bottleneck in the Wazuh 5.0 pipeline, set indexer heap and shards correctly, cut event volume at source and measure your own events per second.11 min read
- 03Multi-Tenant Wazuh for MSSPsRun one Wazuh platform for many customers: tenancy on agent groups, indexer roles with document-level security, per-tenant logins, onboarding and isolation failures.16 min read
- 04Wazuh SSO and RBAC with Entra ID, Okta and KeycloakWire SAML single sign-on into Wazuh 5.0, understand the two separate permission systems behind it, design analyst and tenant roles, and keep a break-glass login that works.11 min read
- 05Cutting Wazuh False Positives Without Going BlindA noise-budget method for Wazuh 5.0: measure findings by rule, classify what you find, tune in the Custom space with Sigma exclusions, and record every exception with an expiry.11 min read
- 06SOAR with Wazuh: n8n, Shuffle and TheHiveDesign a Wazuh SOAR intake in 5.0: alerting monitors per severity, a webhook notification channel, a stable payload contract, dedup and a documented way back.13 min read
- 07Wazuh Compliance: PCI DSS, ISO 27001, SOC 2 and HIPAAUse the native compliance block on Wazuh 5.0 rules, build per-framework views, export audit evidence, and know honestly what Wazuh cannot evidence for you.12 min read
- 08Wazuh Threat Intelligence: CTI, MISP and KVDB ListsHow Wazuh 5.0 enriches events with CTI indicators, what replaced CDB lists, and how to load your own MISP indicators into a KVDB the decoder can match.11 min read
- 09Sigma Rules in Wazuh and ATT&CK CoveragePort a community Sigma rule into Wazuh 5.0, understand which modifiers the fork supports, and measure ATT&CK coverage with a Navigator layer export.12 min read
- 10Hardening Wazuh Itself: Certificates, Exposure, AccessA pentester's read of a default Wazuh 5.0 install: what listens, which credentials ship known, how certificates work, API token hygiene and a checklist.14 min read
- 11AI-Assisted Triage for Wazuh FindingsHow to put a language model in the Wazuh triage path safely: context design, evidence-based verdicts, allowed actions, prompt-injection defence and precision measurement.13 min read
- 12Wazuh 5: What Changes and Why It MattersA practitioner's change inventory for Wazuh 5.0: new paths, agent port 1517, Sigma detection, findings, removed daemons, and the migration you cannot skip.17 min read
- 13Migrating Wazuh 4.x to 5: The RunbookA phase-by-phase Wazuh 5 migration runbook: prerequisites, parallel deployment, groups first, agent cutover on port 1517, validation and rollback.14 min read
- 14What Wazuh Really Costs: Build vs Buy for a SOCWazuh has no licence fee, but a SOC built on it has a bill. A decision framework for build versus buy, by organisation size and security maturity.9 min read