Guilgo Blog

Notes from my daily work with technology.

Kubernetes audit in Wazuh: policy, volume, and webhook (after we broke it)

How to harden the audit policy, keep the disk from filling up, and stop the webhook from swallowing whole EventLists

Hardened Kubernetes audit for Wazuh: first-match policy, port 8088, and one event per datagram—what eight months in a k3s homelab taught us.

Posted by David Guillermo on Saturday, October 3, 2026

Monitor Docker containers with Wazuh docker-listener: no custom rules needed

On 4.14.7 the official ruleset already keys off docker.Action; keep the socket on the host agent, not the manager

Enable Wazuh docker-listener on 4.14.7 without custom rules: the official ruleset already maps docker.Action, and the socket stays on the host agent.

Posted by David Guillermo on Friday, August 28, 2026

Wazuh 5: a production survival guide

Verifiable criteria to go live without the stack overwhelming you

Verifiable criteria to take Wazuh 5 to production: predictable upgrades, signal vs noise, indexer performance, and a pilot with a clear stop rule.

Posted by David Guillermo on Wednesday, April 29, 2026

Build a proactive SOC in a homelab: Kubernetes, Docker, Wazuh, Trivy and Telegram

Low-noise periodic checks: broken pods, high Wazuh alerts, CVEs in exposed images and Telegram reports, with deduplication and clear severity policy

Guide: proactive homelab SOC with k3s, Wazuh, Trivy (CVEs on exposed Docker images) and Telegram. Cron, low noise, dedupe and actionable alerts.

Posted by David Guillermo on Sunday, April 26, 2026

Auditing Kubernetes with Wazuh: API server audit logs into your SIEM

Webhook listener, audit policy, and custom detection rules for create/delete events

Step-by-step guide to audit Kubernetes with Wazuh: API server audit logs to the SIEM, webhook listener, audit policy and rules in local_rules.xml. Kubernetes security monitoring.

Posted by David Guillermo on Thursday, February 26, 2026