# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 2 Related Work  
The integration of machine learning (ML) and artificial intelligence (AI) into cybersecurity frameworks has been extensively explored to enhance threat detection and response in Security Operation Centers (SOCs) [4]. [PERSON] et al. [5] proposed a model-free reinforcement learning (RL) approach for intrusion response systems, training an RL agent in a simulated environment to mitigate complex multistage attacks while minimizing disruption to legitimate network activities. However, their method's effectiveness was constrained by the quality and completeness of training data, potentially missing diverse attack patterns. [PERSON] et al. [6] developed a decision tree-based system for detecting and mitigating DoS and DDoS attacks, introducing the Anomaly2 Sign algorithm to generate Suricata rules from normal and anomalous traffic in an unsupervised manner. Their decision tree model achieved an accuracy of 99.7-99.9%, outperforming other ML classifiers; however, concerns about overfitting due to unrepresentative datasets limit its practical applicability. Advancements in Security Orchestration, Automation, and Response (SOAR) platforms further highlight the role of ML in SOCs. [PERSON] and [PERSON] [7] examined the potential of SOAR solutions integrated with SIEM systems, arguing that AI and ML can enhance automation and operational efficiency for SOC analysts. Similarly, [PERSON] et al. [8] introduced DecOr, a declarative API-driven orchestration framework for SOAR platforms, abstracting complexities in incident response processes to improve response accuracy, though its performance depends on the ontological knowledge base's accuracy. [PERSON] et al. [8] proposed APIRO, an ML-based architecture for automatic API recommendations in SOAR solutions, achieving a Top-1 accuracy of 91.9%, using data augmentation and convolutional neural networks despite data scarcity challenges. A recent study investigated the integration of machine learning with traditional signature-based methods to enhance Network Intrusion Detection and Prevention Systems (NIDPS) against Distributed Denial-of-Service (DDoS) attacks, using Snort for traffic analysis and Wazuh for implementing a Random Forest model and active response mechanism [9]. Their Random Forest model achieved near-perfect metrics (accuracy, precision, recall, and F1-Score of 99.99%) with a training time of 18.84 s, enabling real-time monitoring and mitigation of DDoS attacks. Beyond general AI and ML approaches in cybersecurity, recent research has specifically explored the use and enhancement of the Wazuh platform in various contexts. [PERSON] et al. [10] developed the Security Event Response Copilot (SERC), a system designed to assist analysts in responding to and mitigating security breaches more effectively. This research specifically utilizes Wazuh for capturing, analyzing, and correlating security events from endpoints. SERC leverages Wazuh's capabilities to collect real-time event data and applies a Retrieval-Augmented Generation (RAG) approach to retrieve context-specific insights from three vectorized data collections: incident response knowledge, the MITRE ATT&CK framework, and the NIST Cybersecurity Framework (CSF) 2.0. This integration bridges strategic risk management and tactical intelligence, enabling precise identification of adversarial tactics and techniques while adhering to best practices in cybersecurity. [PERSON] et al. [11] presented a comprehensive study evaluating the security and performance of open-source SIEM solutions for small and medium enterprises (SMEs), with particular attention to Wazuh. This research highlights that SMEs, which are the backbone of the global economy, are particularly vulnerable to cyber threats due to inadequate protection for critical and sensitive information, budgetary constraints, and a lack of cybersecurity expertise and personnel. This study examines the capabilities of open-source SIEM solutions, including Wazuh, in addressing modern security challenges and compliance with regulatory requirements.