Guilgo Blog

Notes from my daily work with technology.

Kubernetes audit in Wazuh: policy, volume, and webhook (after we broke it)

How to harden the audit policy, keep the disk from filling up, and stop the webhook from swallowing whole EventLists

Hardened Kubernetes audit for Wazuh: first-match policy, port 8088, and one event per datagram—what eight months in a k3s homelab taught us.

Posted by David Guillermo on Saturday, October 3, 2026

Monitor Docker containers with Wazuh docker-listener: no custom rules needed

On 4.14.7 the official ruleset already keys off docker.Action; keep the socket on the host agent, not the manager

Enable Wazuh docker-listener on 4.14.7 without custom rules: the official ruleset already maps docker.Action, and the socket stays on the host agent.

Posted by David Guillermo on Friday, August 28, 2026

Prometheus and Alertmanager: automatic Kubernetes remediation with an allowlist

From alert to fix (with a brake): DiskPressure and Failed pods, a local gate, a short allowlist, and a single report

Prometheus and Alertmanager automatic remediation in Kubernetes with an allowlist: DiskPressure, Failed pods, one Telegram report, no cloud agents.

Posted by David Guillermo on Saturday, August 15, 2026

Integrating urlscan.io with Wazuh-lite for Automated Alert Enrichment

Automatically enrich AdGuard and parental control alerts with urlscan.io, dual Telegram notifications, and real reputation verdicts

Learn how to integrate urlscan.io with Wazuh-lite to enrich AdGuard alerts with URL reputation and threat intelligence while keeping your SIEM workflow.

Posted by David Guillermo on Saturday, July 25, 2026

OpenClaw: troubleshooting homelab installation with Docker, Telegram and Ollama

Real errors, causes and copy-paste fixes when OpenClaw doesn't respond

OpenClaw troubleshooting guide for homelab: Telegram webhook 409 conflict, Docker and Ollama, 16k context model, CPU timeouts and OpenAI API alternative.

Posted by David Guillermo on Tuesday, February 17, 2026