Guilgo Blog

Notes from my daily work with technology.

Monitor Docker containers with Wazuh docker-listener: no custom rules needed

On 4.14.7 the official ruleset already keys off docker.Action; keep the socket on the host agent, not the manager

Enable Wazuh docker-listener on 4.14.7 without custom rules: the official ruleset already maps docker.Action, and the socket stays on the host agent.

Posted by David Guillermo on Friday, August 28, 2026

Prometheus and Alertmanager: automatic Kubernetes remediation with an allowlist

From alert to fix (with a brake): DiskPressure and Failed pods, a local gate, a short allowlist, and a single report

Prometheus and Alertmanager automatic remediation in Kubernetes with an allowlist: DiskPressure, Failed pods, one Telegram report, no cloud agents.

Posted by David Guillermo on Saturday, August 15, 2026

Integrating urlscan.io with Wazuh-lite for Automated Alert Enrichment

Automatically enrich AdGuard and parental control alerts with urlscan.io, dual Telegram notifications, and real reputation verdicts

Learn how to integrate urlscan.io with Wazuh-lite to enrich AdGuard alerts with URL reputation and threat intelligence while keeping your SIEM workflow.

Posted by David Guillermo on Saturday, July 25, 2026

OpenClaw: troubleshooting homelab installation with Docker, Telegram and Ollama

Real errors, causes and copy-paste fixes when OpenClaw doesn't respond

OpenClaw troubleshooting guide for homelab: Telegram webhook 409 conflict, Docker and Ollama, 16k context model, CPU timeouts and OpenAI API alternative.

Posted by David Guillermo on Tuesday, February 17, 2026