Episode 1 Tutorial MS Pro
Your sovereign SIEM, learn to read it properly then make it act
Wazuh is installed and you don't know what to do with it. Three first jobs in the right order, without drowning in alerts.
Make Your SIEM Talk
Your SIEM is running, now make it talk, read the right logs, write your own rules, correlate, then let it act.
3 of 5 published · more to come
Episode 2 Tutorial MS Pro
Wazuh, write the rule that catches what you're really after
Writing a custom Wazuh rule isn't about covering everything. It's asking one precise question to a real log, testing it with wazuh-logtest, then shipping it.
Episode 3 Tutorial MS Pro
Santa in Wazuh, from noise to an alert that speaks
A lone Santa block is noise. Correlated in Wazuh, it's a detection. Teach your SIEM to decode then aggregate Santa events.
Spin-off Explainer Going further
Code signing, the shared anchor of Santa and Little Snitch
A Little Snitch alert on your backup is not necessarily a missing signature. What code signing really controls, with Santa in parallel.