# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 2 Related Work
Performance aspects are explored through empirical testing in simulated enterprise-grade SME network environments to assess resource utilization and real-time data processing capabilities. The findings shed light on the strengths and limitations of these systems, aiding decision-makers in selecting the most suitable SIEM solution for their specific requirements while enhancing the cybersecurity posture of SMEs. These use cases demonstrate Wazuh's versatility across different sectors and organizational contexts. However, despite its many advantages, Wazuh implementations present certain limitations. [PERSON] et al. [10] note that existing implementations of Wazuh in SOCs lack direct integration with advanced AI capabilities, which could significantly improve its detection accuracy and responsiveness. Additionally, [PERSON] et al. [11] highlight that effective use of Wazuh requires a certain level of technical expertise, which can be challenging for organizations with limited cybersecurity personnel resources. Unlike previous works that often overlook open-source SIEM solutions like Wazuh and their practical deployment in resource-constrained SOCs, particularly for small and medium enterprises (SMEs), this paper demonstrates the practical application of ML in Wazuh, reducing false positives and improving SOC efficiency through a dual approach of classification and clustering, offering a scalable solution for SMEs. Addressing the growing need for accessible security solutions in cloud environments, [PERSON] et al. [12] introduced a novel approach to cloud-based Wazuh deployment specifically tailored for small businesses with limited technical expertise and resources. Their research emphasizes the user-friendly nature of Wazuh Cloud, providing streamlined deployment and customizable security rules that can be managed by non-technical personnel. This study demonstrates how Wazuh's Host-Based Intrusion Detection System (HIDS) effectively detects and mitigates various threats. A key contribution of this work highlights Wazuh Cloud's cost-effectiveness compared to maintaining dedicated IT security teams, making robust cybersecurity accessible to resource-constrained organizations. This research also addresses implementation challenges such as complexity in setup and configuration, offering practical strategies to simplify deployment and ensure Wazuh can seamlessly expand to accommodate an organization's changing requirements while preserving its efficacy against evolving cyber threats. However, while previous research has explored various machine learning techniques for threat detection, there remains a gap in the practical application of these methods within open-source SIEM platforms, particularly in real-world, resource-constrained SOC environments. In this context, Wazuh--despite its growing adoption--has received limited attention in terms of ML integration tailored to its architecture and operational challenges. This study addresses that gap by presenting a practical and scalable machine learning-enhanced framework for Wazuh, aimed specifically at improving detection accuracy and reducing false positives. By combining supervised classification (Random Forest) with unsupervised clustering (DBSCAN), our approach offers a dual-layer detection strategy that enhances SOC efficiency. It is designed with small and medium-sized enterprises (SMEs) in mind, delivering a lightweight yet effective solution that has been validated in real deployment scenarios.