Guilgo Blog

Notes from my daily work with technology.

Kubernetes audit in Wazuh: policy, volume, and webhook (after we broke it)

How to harden the audit policy, keep the disk from filling up, and stop the webhook from swallowing whole EventLists

Hardened Kubernetes audit for Wazuh: first-match policy, port 8088, and one event per datagram—what eight months in a k3s homelab taught us.

Posted by David Guillermo on Saturday, October 3, 2026

Prometheus and Alertmanager: automatic Kubernetes remediation with an allowlist

From alert to fix (with a brake): DiskPressure and Failed pods, a local gate, a short allowlist, and a single report

Prometheus and Alertmanager automatic remediation in Kubernetes with an allowlist: DiskPressure, Failed pods, one Telegram report, no cloud agents.

Posted by David Guillermo on Saturday, August 15, 2026

Build a proactive SOC in a homelab: Kubernetes, Docker, Wazuh, Trivy and Telegram

Low-noise periodic checks: broken pods, high Wazuh alerts, CVEs in exposed images and Telegram reports, with deduplication and clear severity policy

Guide: proactive homelab SOC with k3s, Wazuh, Trivy (CVEs on exposed Docker images) and Telegram. Cron, low noise, dedupe and actionable alerts.

Posted by David Guillermo on Sunday, April 26, 2026

Wazuh Grafana integration: lightweight dashboard without Elasticsearch

Agents, security alerts (SCA, MITRE), AdGuard and parental control in one dashboard. No Indexer or official Dashboard.

Wazuh Grafana integration without Elasticsearch: a lightweight REST API dashboard for agents, SCA/MITRE alerts and AdGuard. JSON plugin, JWT and proxies.

Posted by David Guillermo on Friday, February 27, 2026

Auditing Kubernetes with Wazuh: API server audit logs into your SIEM

Webhook listener, audit policy, and custom detection rules for create/delete events

Step-by-step guide to audit Kubernetes with Wazuh: API server audit logs to the SIEM, webhook listener, audit policy and rules in local_rules.xml. Kubernetes security monitoring.

Posted by David Guillermo on Thursday, February 26, 2026

avatar

Sysadmin, self-taught by curiosity.

FEATURED TAGS
adguard arch-linux docker homelab k8s kubernetes linux microsoft monitoring parental-control powershell security siem sysadmin tech telegram wazuh wsus