AI Assistance Moves Into SOC Workflows

Security operations centers are drowning in alerts. Every day, they process millions of security events from endpoints, cloud workloads, network devices, and business applications, and analysts are expected to spot the one critical threat hidden among a sea of false positives. To cope, many organizations are turning to artificial intelligence—not to replace human analysts, but to help them work faster and smarter. Wazuh, an open-source security platform, has been exploring this approach with a set of AI-powered tools and integrations designed to fold assistance into everyday SOC workflows.

Why SOCs Are Turning to AI

Modern SOCs face a daunting challenge. They must detect and respond to increasingly sophisticated threats while processing vast numbers of security events. The high volume of alerts contributes to analyst fatigue and raises the risk that critical events get overlooked. Investigations often require juggling multiple dashboards, documentation, vulnerability databases, and threat intelligence feeds before a full picture emerges.

As infrastructure becomes more distributed—spanning on-premises and cloud environments—maintaining consistent situational awareness becomes even harder. AI-assisted workflows aim to reduce repetitive analysis, add context, and accelerate investigative decision-making, without taking the human out of the loop.

Wazuh’s AI Analyst

For Wazuh Cloud subscribers, the Wazuh AI Analyst offers an automated, hands-off approach to security reporting. It processes security data through Amazon Bedrock and Anthropic’s Claude, delivering insights without manual configuration. The service periodically emails key indicators, a histogram of protected endpoints, alert volume, active vulnerabilities, and a posture summary, with a full PDF report attached.

Reports are generated on the subscription’s schedule and sent to the registered email address. They can also be viewed in the Wazuh Cloud console under Environments > AI Reports. The AI Analyst is designed to be advisory—its recommendations should be validated against an organization’s own policies before acting.

Privacy and Data Handling

On privacy, Wazuh states that subscription data is not shared with third parties and is not used to train AI models. Data is processed only to generate reports, with encrypted transmission, isolated processing, and no permanent storage. For organizations that self-deploy Wazuh, integrations with third-party AI providers are available, and a self-hosted option keeps everything on the organization's own network.

Self-Hosted Llama 3 and Ollama

For teams with strict privacy or data-residency requirements, Wazuh offers a self-hosted integration using Meta’s open-source Llama LLM, run locally via Ollama on the Wazuh server. A Python script decompresses archived logs for a chosen period, vectorizes them into a FAISS store, and serves a LangChain-powered chatbot that analysts can query. Nothing is sent to a cloud provider, making it a good fit for privacy-sensitive environments.

Full setup steps are available in the Wazuh blog post: Leveraging artificial intelligence for threat hunting in Wazuh.

External Integration with Claude 3.5 Haiku

Alternatively, Wazuh can integrate with Anthropic’s Claude 3.5 Haiku, hosted on Amazon Bedrock, and surface it as a chat box inside the dashboard through the OpenSearch Assistant. Setup involves enabling the model in Bedrock, installing the relevant OpenSearch plugins, and creating an ML Commons connector, model, and conversational agent. The assistant can provide guidance on common tasks, such as what to do about a finding and how to configure certain settings.

Detailed setup instructions are published in the Wazuh blog post: Leveraging Claude Haiku in the Wazuh dashboard for LLM-powered insights.

What This Means for Analysts

The introduction of AI into SOC workflows is not about replacing human expertise. Instead, the idea is to reduce repetitive work, accelerate investigations, and provide contextual support for detection, triage, and response. Analysts remain responsible for validation and consequential decisions.

Wazuh’s approach—offering both a managed cloud service and self-hosted options—gives organizations flexibility. They can adopt AI in a way that aligns with their operational, privacy, and data-residency requirements. As AI becomes more embedded in security tools, the pressure will be on organizations to define clear policies for how to validate AI-generated recommendations and ensure human oversight.