Wazuh has introduced advanced capabilities that integrate artificial intelligence into its threat hunting process. By pairing its Security Event and Incident Management (SIEM) and Extended Detection and Response (XDR) capabilities with locally deployed large language models (LLMs), Wazuh now enables analysts to detect stealthy threats that would otherwise bypass traditional rule-based detection.
Threat hunting is a proactive approach to security that looks beyond alerts and scans to uncover hidden adversaries and early-stage intrusions. Wazuh’s new integration leverages LLMs such as LLaMA 3 running on Ollama, combined with vectorized log data and LangChain, to enable security teams to query recent logs using natural language and receive detailed, context-rich responses. This setup allows Wazuh users to:
- Analyze thousands of logs at once for anomalous patterns, lateral movement, or misuse of Living Off the Land Binaries (LOLBins)
- Detect brute force attacks, unauthorized access attempts, and data exfiltration attempts-even when no explicit detection rule exists
- Query for threats in plain English (“Were there any failed SSH logins in the last 24 hours?”) and receive investigative context from the LLM
The threat hunting engine supports both Linux and Windows endpoints, and is fully local, ensuring that sensitive telemetry never leaves the analyst’s environment. The LLM is deployed on-premise, and responses are derived from archived log data processed via FAISS vector stores, HuggingFace embeddings, and a Python-based QA chain.
“Traditional rulesets will always be reactive by design,” said Santiago Bassett, Founder & CEO, Wazuh. “By integrating local LLMs, we give defenders the power to ask broader questions, uncover unknown threats, and collapse the time to detection.”
Wazuh also supports dashboard integration for AI-assisted analysis, allowing users to interact with the LLM through a chatbot embedded directly in the OpenSearch-based UI. Queries such as “Who attempted to exfiltrate files this week?” now return event-specific responses with timestamps, user identities, and attack vectors, backed by log forensics. This enhancement reflects Wazuh’s continued commitment to empowering defenders with open, extensible, and privacy-respecting tools for modern, community-powered threat detection.
