Guilgo Blog

Notes from my daily work with technology.

Integrating urlscan.io with Wazuh-lite for Automated Alert Enrichment

Automatically enrich AdGuard and parental control alerts with urlscan.io, dual Telegram notifications, and real reputation verdicts

Learn how to integrate urlscan.io with Wazuh-lite to enrich AdGuard alerts with URL reputation and threat intelligence while keeping your SIEM workflow.

Posted by David Guillermo on Saturday, July 25, 2026

How to Detect Compromised AUR Packages with Wazuh and Telegram on Arch Linux

Hourly checks against aur-malware-check, custom decoders, and level-12 alerts if a package from the atomic-lockfile attack is installed

Guide to detect compromised AUR packages on Arch Linux using Wazuh and Telegram: hourly aur-malware-check, custom decoders, and level-12 alerts.

Posted by David Guillermo on Sunday, June 14, 2026

Wazuh 5: a production survival guide

Verifiable criteria to go live without the stack overwhelming you

Verifiable criteria to take Wazuh 5 to production: predictable upgrades, signal vs noise, indexer performance, and a pilot with a clear stop rule.

Posted by David Guillermo on Wednesday, April 29, 2026

Build a proactive SOC in a homelab: Kubernetes, Docker, Wazuh, Trivy and Telegram

Low-noise periodic checks: broken pods, high Wazuh alerts, CVEs in exposed images and Telegram reports, with deduplication and clear severity policy

Guide: proactive homelab SOC with k3s, Wazuh, Trivy (CVEs on exposed Docker images) and Telegram. Cron, low noise, dedupe and actionable alerts.

Posted by David Guillermo on Sunday, April 26, 2026

Wazuh Grafana integration: lightweight dashboard without Elasticsearch

Agents, security alerts (SCA, MITRE), AdGuard and parental control in one dashboard. No Indexer or official Dashboard.

Wazuh Grafana integration without Elasticsearch: a lightweight REST API dashboard for agents, SCA/MITRE alerts and AdGuard. JSON plugin, JWT and proxies.

Posted by David Guillermo on Friday, February 27, 2026

Auditing Kubernetes with Wazuh: API server audit logs into your SIEM

Webhook listener, audit policy, and custom detection rules for create/delete events

Step-by-step guide to audit Kubernetes with Wazuh: API server audit logs to the SIEM, webhook listener, audit policy and rules in local_rules.xml. Kubernetes security monitoring.

Posted by David Guillermo on Thursday, February 26, 2026

avatar

Sysadmin, self-taught by curiosity.

FEATURED TAGS
adguard docker homelab kubernetes linux microsoft monitoring parental-control powershell security siem sysadmin telegram wazuh wsus