Wazuh adds AI analyst workflows to its security platform

Wazuh has added AI-enabled workflows to its security operations platform, positioning the Wazuh AI Analyst as a key feature for both Wazuh Cloud subscribers and users who self-host the solution. On the cloud side, the AI Analyst automatically processes security data through Amazon Bedrock and Anthropic’s Claude to generate periodic reports that cover indicators, alert volumes, endpoint coverage, active vulnerabilities, and a posture summary in PDF form.

These reports are emailed on a scheduled cadence and can also be viewed in the Wazuh Cloud console under Environments > AI Reports. The company emphasises privacy by stating that subscription data is not shared with third parties, is not used to train AI models, and is transmitted with encryption and isolated processing; the AI outputs are explicitly described as advisory rather than prescriptive. The article attributes these capabilities to Wazuh’s Cloud offering and to its integrations with third-party AI providers.

Beyond the cloud, Wazuh highlights options for organisations that prefer self-hosted AI or externally managed AI integrations. The piece describes a self-hosted Llama 3 and Ollama setup, where logs are decompressed, vectorised into a FAISS store, and served via a LangChain-powered chatbot entirely on the user’s network. It also notes an externally managed integration with Claude 3.5 Haiku, hosted on Amazon Bedrock and accessible through the OpenSearch Assistant.

Full setup steps are linked to Wazuh’s own blog posts. The article frames these options as enabling threat hunting and enhanced SOC workflows while preserving privacy and data residency requirements, with guidance on tailoring AI adoption to organisational policies.