{"id":110,"date":"2025-11-30T16:33:09","date_gmt":"2025-11-30T16:33:09","guid":{"rendered":"https:\/\/adler-tech.com\/?page_id=110"},"modified":"2026-04-14T08:57:07","modified_gmt":"2026-04-14T07:57:07","slug":"wazuh-advanced-training","status":"publish","type":"page","link":"https:\/\/adler-tech.com\/?page_id=110","title":{"rendered":"Wazuh Advanced Training"},"content":{"rendered":"\n

3 days (24 hours total)<\/strong><\/p>\n\n\n\n

\n\n\n\n

<\/h1>\n\n\n\n

Day 1 \u2014 Advanced Architecture & Detection Engineering (8h)<\/strong><\/h2>\n\n\n\n

Chapter 1: Advanced Wazuh Architecture (1h)<\/strong><\/h3>\n\n\n\n
    \n
  • Multi-manager topologies<\/li>\n\n\n\n
  • Distributed indexer clusters<\/li>\n\n\n\n
  • HA strategies<\/li>\n\n\n\n
  • Load balancing<\/li>\n<\/ul>\n\n\n\n

    Chapter 2: Advanced Agent Behavior (1h)<\/strong><\/h3>\n\n\n\n
      \n
    • Agent internal queues<\/li>\n\n\n\n
    • Log batching<\/li>\n\n\n\n
    • Secure enrollment tokens<\/li>\n\n\n\n
    • Agentless SSH-based monitoring (deep dive)<\/li>\n<\/ul>\n\n\n\n

      Chapter 3: Deep Dive into Decoders (2h)<\/strong><\/h3>\n\n\n\n
        \n
      • Chained decoders<\/li>\n\n\n\n
      • Regex optimization<\/li>\n\n\n\n
      • Json\/XML\/YAML parsing<\/li>\n\n\n\n
      • Using wazuh-logtest<\/em> for profiling<\/li>\n<\/ul>\n\n\n\n

        Chapter 4: Detection Engineering with Custom Rules (2h)<\/strong><\/h3>\n\n\n\n
          \n
        • Writing high-fidelity rules<\/li>\n\n\n\n
        • Thresholding & correlation<\/li>\n\n\n\n
        • Dynamic fields<\/li>\n\n\n\n
        • Multi-event correlation patterns<\/li>\n\n\n\n
        • Testing accuracy vs noise<\/li>\n<\/ul>\n\n\n\n

          Chapter 5: Zero-Noise Ruleset Tuning (2h)<\/strong><\/h3>\n\n\n\n
            \n
          • Noise sources identification<\/li>\n\n\n\n
          • Module-level tuning (FIM, SCA, Syscollector, Vulnerabilities)<\/li>\n\n\n\n
          • Log pipeline suppression<\/li>\n\n\n\n
          • Scaling ruleset performance<\/li>\n<\/ul>\n\n\n\n
            \n\n\n\n

            Day 2 \u2014 Threat Intelligence, Integrations & Pipelines (8h)<\/strong><\/h2>\n\n\n\n

            Chapter 6: Threat Intelligence Integration (2h)<\/strong><\/h3>\n\n\n\n
              \n
            • MISP integration<\/li>\n\n\n\n
            • STIX\/TAXII feeds<\/li>\n\n\n\n
            • Custom IOC lists<\/li>\n\n\n\n
            • Reputation-based alerting<\/li>\n<\/ul>\n\n\n\n

              Chapter 7: Advanced Log Pipelines (2h)<\/strong><\/h3>\n\n\n\n
                \n
              • Multi-source log ingestion<\/li>\n\n\n\n
              • Remote syslog architectures<\/li>\n\n\n\n
              • Log normalization strategy<\/li>\n\n\n\n
              • Performance considerations<\/li>\n<\/ul>\n\n\n\n

                Chapter 8: Cloud & Container Security (2h)<\/strong><\/h3>\n\n\n\n
                  \n
                • AWS CloudTrail & Config<\/li>\n\n\n\n
                • Azure Activity Logs<\/li>\n\n\n\n
                • Kubernetes auditing<\/li>\n\n\n\n
                • Docker runtime logs<\/li>\n<\/ul>\n\n\n\n

                  Chapter 9: External Analytics & SIEM Integration (2h)<\/strong><\/h3>\n\n\n\n
                    \n
                  • Splunk<\/li>\n\n\n\n
                  • Elastic federated search<\/li>\n\n\n\n
                  • Loki\/Grafana stack<\/li>\n\n\n\n
                  • Forwarding Wazuh alerts to external SIEMs<\/li>\n<\/ul>\n\n\n\n
                    \n\n\n\n

                    Day 3 \u2014 Operations, Security Hardening & Automation (8h)<\/strong><\/h2>\n\n\n\n

                    Chapter 10: Wazuh Manager Hardening (1h)<\/strong><\/h3>\n\n\n\n
                      \n
                    • TLS for all components<\/li>\n\n\n\n
                    • API security hardening<\/li>\n\n\n\n
                    • Role-based access<\/li>\n\n\n\n
                    • Secrets storage<\/li>\n<\/ul>\n\n\n\n

                      Chapter 11: Indexer Optimization & Scaling (1h)<\/strong><\/h3>\n\n\n\n
                        \n
                      • Shards & replicas design<\/li>\n\n\n\n
                      • Hot\/warm\/cold storage<\/li>\n\n\n\n
                      • Curator strategies<\/li>\n\n\n\n
                      • High-ingest tuning<\/li>\n<\/ul>\n\n\n\n

                        Chapter 12: Automated Operations (2h)<\/strong><\/h3>\n\n\n\n
                          \n
                        • Terraform deployment of Wazuh<\/li>\n\n\n\n
                        • Ansible collections<\/li>\n\n\n\n
                        • Automated agent rollout<\/li>\n\n\n\n
                        • Continuous configuration enforcement<\/li>\n<\/ul>\n\n\n\n

                          Chapter 13: Advanced Dashboards & Visualizations (2h)<\/strong><\/h3>\n\n\n\n
                            \n
                          • Custom dashboards<\/li>\n\n\n\n
                          • Threat-hunting views<\/li>\n\n\n\n
                          • Correlation visualizations<\/li>\n\n\n\n
                          • SLA monitoring dashboards<\/li>\n<\/ul>\n\n\n\n

                            Chapter 14: Incident Response Workflow Integration (2h)<\/strong><\/h3>\n\n\n\n
                              \n
                            • SOAR platforms<\/li>\n\n\n\n
                            • Automated ticketing (Jira, ServiceNow)<\/li>\n\n\n\n
                            • Enrichment hooks<\/li>\n\n\n\n
                            • Playbook triggers<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

                              3 days (24 hours total) Day 1 \u2014 Advanced Architecture & Detection Engineering (8h) Chapter 1: Advanced Wazuh Architecture (1h) Chapter 2: Advanced Agent Behavior (1h) Chapter 3: Deep Dive into Decoders (2h) Chapter 4: Detection Engineering with Custom Rules (2h) Chapter 5: Zero-Noise Ruleset Tuning (2h) Day 2 \u2014 Threat Intelligence, Integrations & Pipelines […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":106,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-110","page","type-page","status-publish","hentry"],"yoast_head":"\nWazuh Advanced Training - ADLER-TECH<\/title>\n<meta name=\"description\" content=\"Advanced training for Wazuh focues on agent behavior, detection rules, adjusting rules to your liking. Integration with Splunk\/ELK\/Grafana\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/adler-tech.com\/?page_id=110\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Wazuh Advanced Training - ADLER-TECH\" \/>\n<meta property=\"og:description\" content=\"Advanced training for Wazuh focues on agent behavior, detection rules, adjusting rules to your liking. Integration with Splunk\/ELK\/Grafana\" \/>\n<meta property=\"og:url\" content=\"https:\/\/adler-tech.com\/?page_id=110\" \/>\n<meta property=\"og:site_name\" content=\"ADLER-TECH\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-14T07:57:07+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/adler-tech.com\\\/?page_id=110\",\"url\":\"https:\\\/\\\/adler-tech.com\\\/?page_id=110\",\"name\":\"Wazuh Advanced Training - ADLER-TECH\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/adler-tech.com\\\/#website\"},\"datePublished\":\"2025-11-30T16:33:09+00:00\",\"dateModified\":\"2026-04-14T07:57:07+00:00\",\"description\":\"Advanced training for Wazuh focues on agent behavior, detection rules, adjusting rules to your liking. Integration with Splunk\\\/ELK\\\/Grafana\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/adler-tech.com\\\/?page_id=110#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/adler-tech.com\\\/?page_id=110\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/adler-tech.com\\\/?page_id=110#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/adler-tech.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trainings\",\"item\":\"https:\\\/\\\/adler-tech.com\\\/?page_id=7\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"SIEM\\\/EDR\",\"item\":\"https:\\\/\\\/adler-tech.com\\\/?page_id=106\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Wazuh Advanced Training\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/adler-tech.com\\\/#website\",\"url\":\"https:\\\/\\\/adler-tech.com\\\/\",\"name\":\"ADLER-TECH\",\"description\":\"Best IT trainings, support and bodyleasing\",\"publisher\":{\"@id\":\"https:\\\/\\\/adler-tech.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/adler-tech.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/adler-tech.com\\\/#organization\",\"name\":\"ADLER-TECH\",\"url\":\"https:\\\/\\\/adler-tech.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/adler-tech.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/adler-tech.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/ADLER-TECH_LOGO.png\",\"contentUrl\":\"https:\\\/\\\/adler-tech.com\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/ADLER-TECH_LOGO.png\",\"width\":361,\"height\":121,\"caption\":\"ADLER-TECH\"},\"image\":{\"@id\":\"https:\\\/\\\/adler-tech.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/110643968\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Wazuh Advanced Training - ADLER-TECH","description":"Advanced training for Wazuh focues on agent behavior, detection rules, adjusting rules to your liking. Integration with Splunk\/ELK\/Grafana","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/adler-tech.com\/?page_id=110","og_locale":"en_US","og_type":"article","og_title":"Wazuh Advanced Training - ADLER-TECH","og_description":"Advanced training for Wazuh focues on agent behavior, detection rules, adjusting rules to your liking. Integration with Splunk\/ELK\/Grafana","og_url":"https:\/\/adler-tech.com\/?page_id=110","og_site_name":"ADLER-TECH","article_modified_time":"2026-04-14T07:57:07+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/adler-tech.com\/?page_id=110","url":"https:\/\/adler-tech.com\/?page_id=110","name":"Wazuh Advanced Training - ADLER-TECH","isPartOf":{"@id":"https:\/\/adler-tech.com\/#website"},"datePublished":"2025-11-30T16:33:09+00:00","dateModified":"2026-04-14T07:57:07+00:00","description":"Advanced training for Wazuh focues on agent behavior, detection rules, adjusting rules to your liking. Integration with Splunk\/ELK\/Grafana","breadcrumb":{"@id":"https:\/\/adler-tech.com\/?page_id=110#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/adler-tech.com\/?page_id=110"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/adler-tech.com\/?page_id=110#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/adler-tech.com\/"},{"@type":"ListItem","position":2,"name":"Trainings","item":"https:\/\/adler-tech.com\/?page_id=7"},{"@type":"ListItem","position":3,"name":"SIEM\/EDR","item":"https:\/\/adler-tech.com\/?page_id=106"},{"@type":"ListItem","position":4,"name":"Wazuh Advanced Training"}]},{"@type":"WebSite","@id":"https:\/\/adler-tech.com\/#website","url":"https:\/\/adler-tech.com\/","name":"ADLER-TECH","description":"Best IT trainings, support and bodyleasing","publisher":{"@id":"https:\/\/adler-tech.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/adler-tech.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/adler-tech.com\/#organization","name":"ADLER-TECH","url":"https:\/\/adler-tech.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/adler-tech.com\/#\/schema\/logo\/image\/","url":"https:\/\/adler-tech.com\/wp-content\/uploads\/2026\/04\/ADLER-TECH_LOGO.png","contentUrl":"https:\/\/adler-tech.com\/wp-content\/uploads\/2026\/04\/ADLER-TECH_LOGO.png","width":361,"height":121,"caption":"ADLER-TECH"},"image":{"@id":"https:\/\/adler-tech.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/110643968"]}]}},"_links":{"self":[{"href":"https:\/\/adler-tech.com\/index.php?rest_route=\/wp\/v2\/pages\/110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/adler-tech.com\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/adler-tech.com\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/adler-tech.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/adler-tech.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=110"}],"version-history":[{"count":1,"href":"https:\/\/adler-tech.com\/index.php?rest_route=\/wp\/v2\/pages\/110\/revisions"}],"predecessor-version":[{"id":111,"href":"https:\/\/adler-tech.com\/index.php?rest_route=\/wp\/v2\/pages\/110\/revisions\/111"}],"up":[{"embeddable":true,"href":"https:\/\/adler-tech.com\/index.php?rest_route=\/wp\/v2\/pages\/106"}],"wp:attachment":[{"href":"https:\/\/adler-tech.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}