Integrating Claude 3.5 Haiku LLM in Wazuh Dashboard for AI-Powered Security Insights#

1
# Enable AI Assistant features
2
assistant.chat.enabled: true
3
observability.query_assist.enabled: true

1
PUT /_cluster/settings
2
{
3
  "persistent": {
4
    "plugins.ml_commons.only_run_on_ml_node": "false"
5
  }
6
}

1
POST /_plugins/_ml/connectors/_create
2
{
3
  "name": "Amazon Bedrock Claude Haiku",
4
  "description": "Connector for Claude 3.5 Haiku security analysis",
5
  "version": 1,
6
  "protocol": "aws_sigv4",
7
  "credential": {
8
    "access_key": "YOUR_ACCESS_KEY",
9
    "secret_key": "YOUR_SECRET_KEY"
10
  },
11
  "parameters": {
12
    "region": "us-west-2",
13
    "service_name": "bedrock",
14
    "auth": "Sig_V4",
15
    "response_filter": "$.content[0].text",
16
    "max_tokens_to_sample": "8000",
17
    "anthropic_version": "bedrock-2023-05-31",
18
    "model": "anthropic.claude-3-5-haiku-20241022-v1:0"
19
  },
20
  "actions": [
21
    {
22
      "action_type": "predict",
23
      "method": "POST",
24
      "headers": {
25
        "content-type": "application/json"
26
      },
27
      "url": "https://bedrock-runtime.us-west-2.amazonaws.com/model/${parameters.model}/invoke",
28
      "request_body": "{\"messages\":[{\"role\":\"user\",\"content\":[{\"type\":\"text\",\"text\":\"${parameters.prompt}\"}]}],\"anthropic_version\":\"${parameters.anthropic_version}\",\"max_tokens\":${parameters.max_tokens_to_sample}}"
29
    }
30
  ]
31
}

1
POST /_plugins/_ml/model_groups/_register
2
{
3
  "name": "Wazuh Security AI",
4
  "description": "AI models for security analysis"
5
}

1
POST /_plugins/_ml/models/_register?deploy=true
2
{
3
  "name": "Claude Security Assistant",
4
  "function_name": "remote",
5
  "model_group_id": "YOUR_MODEL_GROUP_ID",
6
  "description": "Claude 3.5 Haiku for Wazuh security analysis",
7
  "connector_id": "YOUR_CONNECTOR_ID"
8
}

1
POST /_plugins/_ml/agents/_register
2
{
3
  "name": "Wazuh_Security_AI_Agent",
4
  "type": "conversational",
5
  "description": "AI agent specialized in Wazuh and security operations",
6
  "llm": {
7
    "model_id": "YOUR_MODEL_ID",
8
    "parameters": {
9
      "max_iteration": 5,
10
      "stop_when_no_tool_found": true
11
    }
12
  },
13
  "memory": {
14
    "type": "conversation_index"
15
  },
16
  "tools": [
17
    {
18
      "type": "MLModelTool",
19
      "name": "security_assistant",
20
      "description": "Security analysis and Wazuh expertise",
21
      "parameters": {
22
        "model_id": "YOUR_MODEL_ID",
23
        "prompt": "Human: You are a Wazuh security expert AI assistant. You help with:\n- Explaining Wazuh alerts and their severity\n- Providing security best practices\n- Analyzing vulnerabilities and suggesting remediation\n- Writing Wazuh rules and decoders\n- Incident response guidance\n- MITRE ATT&CK framework mapping\n\nAlways provide accurate, actionable security advice. If unsure, recommend consulting official Wazuh documentation.\n\n${parameters.chat_history:-}\n\nHuman: ${parameters.question}\n\nAssistant:"
24
      }
25
    }
26
  ]
27
}

1
PUT .plugins-ml-config/_doc/os_chat
2
{
3
  "type": "os_chat_root_agent",
4
  "configuration": {
5
    "agent_id": "YOUR_AGENT_ID"
6
  }
7
}

1
Rule ID 5716 is a Wazuh SSH authentication failure alert with severity level 5 (medium).
2

3
This rule triggers when someone fails to authenticate via SSH. Key details:
4
- Indicates potential brute force attempts
5
- Monitor for multiple failures from same IP
6
- Check if source IP is known/authorized
7
- Consider implementing fail2ban or active response
8

9
Recommended actions:
10
1. Review source IP reputation
11
2. Check for pattern of attempts
12
3. Verify user exists
13
4. Enable rate limiting if frequent

1
For critical vulnerability CVE-2024-1234:
2

3
Immediate Actions:
4
1. Identify affected systems using Wazuh vulnerability detector
5
2. Check if exploit is in the wild (check threat intel)
6
3. Assess exposure (internet-facing? critical data?)
7

8
Remediation Steps:
9
1. Apply vendor patches immediately if available
10
2. If no patch: implement compensating controls
11
3. Monitor for exploitation attempts
12
4. Update Wazuh rules to detect exploitation
13

14
Post-Remediation:
15
- Rescan to verify patch application
16
- Document remediation in ticket system
17
- Schedule follow-up vulnerability scan

1
<group name="sudo,">
2
  <rule id="100200" level="5">
3
    <if_sid>5402</if_sid>
4
    <match>authentication failure</match>
5
    <description>Failed sudo authentication attempt</description>
6
    <group>authentication_failed,</group>
7
  </rule>
8

9
  <rule id="100201" level="10" frequency="5" timeframe="300">
10
    <if_matched_sid>100200</if_matched_sid>
11
    <same_user />
12
    <description>Multiple failed sudo attempts by $(user)</description>
13
    <mitre>
14
      <id>T1548.003</id>
15
    </mitre>
16
    <group>authentication_failures,</group>
17
  </rule>
18
</group>

1
CRITICAL: Ransomware Incident Response
2

3
Immediate Actions (0-15 minutes):
4
1. ISOLATE affected systems - disconnect network
5
2. ALERT incident response team
6
3. PRESERVE evidence - capture memory, logs
7
4. IDENTIFY patient zero and infection vector
8

9
Containment (15-60 minutes):
10
1. Block C2 communications at firewall
11
2. Disable affected user accounts
12
3. Reset credentials for privileged accounts
13
4. Check backups integrity (air-gapped?)
14

15
Investigation:
16
1. Timeline reconstruction using Wazuh logs
17
2. Search for IOCs across infrastructure
18
3. Identify lateral movement patterns
19
4. Check for data exfiltration
20

21
Recovery:
22
1. Restore from clean backups
23
2. Rebuild affected systems
24
3. Apply all security patches
25
4. Enhanced monitoring for reinfection

1
// Verify AWS credentials
2
{
3
  "error": "The security token included in the request is invalid"
4
}
5

6
// Solution: Regenerate IAM credentials and update connector