Does anyone have experience or feedback regarding use of Wazuh as a SIEM, specifically for a small (~50 person) company and with all infrastructure in the public cloud?

Threat Intelligence & Incident Response Secure Code & Automation (DevSecOps)

2.1k views3 Comments

Sort by:

CISO in Education3 months ago

The new versión, 4.12 es PERFECT!!! I have 300 Devices....

CEO, MSSP - High Assurance Cybersecurity SOC in Services (non-Government)3 years ago

We've used stable versions in the past... takes a little bit of getting used to. For a small business well worth it if you have someone who can spend some time understanding it. At the end of the day it is a SIEM and will need nurturing and care.

CTO in Transportation3 years ago

Yes we are using it. We are using aws and we have been using Wazuh for close to 7 years now. No issues at all.

Content you might like

Has your organization experienced model denial of service attacks on its LLM?

Yes43%

Not to my knowledge55%

Not sure

View Results

What tools/services do you use for CTEM (continuous threat exposure management)?

How are you making sure the security team has visibility into social engineering attempts on helpdesk staff, especially with attacks using voice impersonation or other deepfake techniques?

Disesdi Susanna Cox outlines 3 critical threats:
1. Non-deterministic decisions – same prompt, different actions (e.g., unintended transfers).
2. Cascading failures – multi-step tasks = more attack surface.
3. Emergent behavior – guardrails can’t cover infinite edge cases; focus on blast radius and recovery.

3 Controls to Implement Now:
• Map agent workflows to attack tactics (MITRE ATLAS)
• Weekly prompt-injection tests (OWASP + CSA)
• Least-privilege, expiring agent tokens (NIST AI RMF + CSA MAESTRO)

Which control or framework gives you the biggest headache, and how are you tackling it?

Full analysis: https://disesdi.substack.com/p/openai-just-dropped-their-agentic

What area(s) do you think your organization should improve to strengthen its cybersecurity posture?

Building an effective incident response plan31%

Educating and training employees on cybersecurity60%

Enforcing password and access management50%

Protecting endpoint devices40%

Integrating security solutions24%

Embracing the cloud9%