SOC Automation
Wazuh alert routing with n8n
A documented workflow that forwards Wazuh alerts into n8n, creates Jira issues, notifies Slack, and sends severity-based email.
Wazuhn8nJiraSlackEmail
Insights · Projects, labs & writing
Everything I have built and written.
Case studies from SOC labs, plus short summaries of published guides. Sources establish authorship; they are not an audit of a production deployment.
On this page
5+
Case studies
2+
More labs
13+
Guides
5+
Topics
Start with a lab
Projects & labs
Detection pipelines, built and documented.
Personal projects, learning labs, and published walkthroughs. Filter by category, then open a case to see the problem, the approach, and the public evidence.
6 projects shown
Detection Lab
Anomaly detection with Wazuh and Elastic
A simulated SOC workflow using external machine learning to identify unusual activity and visualize findings.
WazuhElasticMachine learningDashboards
SIEM Engineering
Wazuh tenant separation
Role-based permissions and tenant-specific views in a Wazuh environment.
WazuhRBACDashboards
Infrastructure Automation
Wazuh deployment on AWS with Ansible
A published lab guide for automating an all-in-one Wazuh deployment on EC2.
WazuhAWS EC2Ansible
Detection Engineering
Windows behavioral detection with Sysmon
A published lab using Sysmon events and Wazuh rules to investigate LOLBin abuse.
SysmonWazuhWindows
Endpoint Detection Lab
Wazuh file monitoring with YARA
A published walkthrough combining file-change monitoring with rule-based malware scanning.
Wazuh FIMYARA
Additional work
SOC Automation
Wazuh-to-osTicket alert ticketing
Publicly described integration that turns Wazuh alerts into osTicket tickets.
View on LinkedIn(opens in a new tab)AI Security
OWASP LLM security CTF
An educational challenge application based on OWASP LLM risks.
View repository(opens in a new tab)Learning exercise
Introductory endpoint utilities
Small endpoint utilities written as learning exercises, not a commercial EDR product.
View repository(opens in a new tab)
Writing
Guides for Wazuh and SOC teams.
Short summaries of published guides. Each card opens the original article on Medium.
14 guides shown
Threat Modeling
Wazuh architecture threat modeling
Read on Medium ↗ (opens in a new tab)
Cloud
Google Cloud network load-balancing lab
Read on Medium ↗ (opens in a new tab)
SIEM
QRadar Community Edition deployment lab
Read on Medium ↗ (opens in a new tab)
SIEM
Forwarding Wazuh data into Datadog
Read on Medium ↗ (opens in a new tab)
Automation
Connecting Wazuh alerts to SimpleRisk
Read on Medium ↗ (opens in a new tab)
Threat Modeling
STRIDE analysis with OWASP Threat Dragon
Read on Medium ↗ (opens in a new tab)
Detection
Investigating LOLBin activity with Sysmon and Wazuh
Read on Medium ↗ (opens in a new tab)
Detection
Windows ETW analysis and evasion lab
Read on Medium ↗ (opens in a new tab)
SIEM
Monitoring a DVWA training environment with Wazuh
Read on Medium ↗ (opens in a new tab)
Detection
File-change detection with Wazuh and YARA
Read on Medium ↗ (opens in a new tab)
Cloud
Automating an EC2 Wazuh deployment with Ansible
Read on Medium ↗ (opens in a new tab)
SIEM
Wazuh integration with VirusTotal
Read on Medium ↗ (opens in a new tab)
AI Security
Exploring natural-language Wazuh queries through MCP
Integration walkthrough using the open-source mcp-server-wazuh by gbrigandi.
Read on Medium ↗ (opens in a new tab)
Automation
Routing Wazuh alerts through n8n, Jira, and Slack
Read on Medium ↗ (opens in a new tab)