Guilgo Blog

Notes from my daily work with technology.

Kubernetes audit in Wazuh: policy, volume, and webhook (after we broke it)

How to harden the audit policy, keep the disk from filling up, and stop the webhook from swallowing whole EventLists

Hardened Kubernetes audit for Wazuh: first-match policy, port 8088, and one event per datagram—what eight months in a k3s homelab taught us.

Posted by David Guillermo on Saturday, October 3, 2026