Guilgo Blog

Notes from my daily work with technology.

Build a proactive SOC in a homelab: Kubernetes, Docker, Wazuh, Trivy and Telegram

Low-noise periodic checks: broken pods, high Wazuh alerts, CVEs in exposed images and Telegram reports, with deduplication and clear severity policy

Guide: proactive homelab SOC with k3s, Wazuh, Trivy (CVEs on exposed Docker images) and Telegram. Cron, low noise, dedupe and actionable alerts.

Posted by David Guillermo on Sunday, April 26, 2026

Wazuh Grafana integration: lightweight dashboard without Elasticsearch

Agents, security alerts (SCA, MITRE), AdGuard and parental control in one dashboard. No Indexer or official Dashboard.

Wazuh Grafana integration without Elasticsearch: a lightweight REST API dashboard for agents, SCA/MITRE alerts and AdGuard. JSON plugin, JWT and proxies.

Posted by David Guillermo on Friday, February 27, 2026

Auditing Kubernetes with Wazuh: API server audit logs into your SIEM

Webhook listener, audit policy, and custom detection rules for create/delete events

Step-by-step guide to audit Kubernetes with Wazuh: API server audit logs to the SIEM, webhook listener, audit policy and rules in local_rules.xml. Kubernetes security monitoring.

Posted by David Guillermo on Thursday, February 26, 2026

Prioritize critical patches in WSUS when Wazuh detects CVEs

From Vulnerability Detector alerts to controlled deployment on Windows

Practical workflow to approve and deploy only critical updates in WSUS when Wazuh alerts on vulnerabilities, with pilot groups and prioritization criteria.

Posted by David Guillermo on Friday, February 6, 2026

Parental control with Wazuh, AdGuard and Telegram

Implementation of a full open-source parental control system using Wazuh as SIEM, AdGuard Home for DNS filtering and Telegram for real-time alerts.

Posted by David Guillermo on Sunday, November 30, 2025

Monitoring WireGuard logs with Wazuh

Practical guide to integrate WireGuard log monitoring with Wazuh, using rsyslog to capture kernel events and custom decoders for security alerts.

Posted by David Guillermo on Monday, November 24, 2025