# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 3 Materials and Methods
### Design of ML-SOC Architecture and Integration
Wazuh agents deployed across monitored systems collect security events and apply predefined rulesets enhanced with contextual enrichment and initial threat scoring. **Agent Configuration and Data Collection:** Wazuh agents receive enhanced configuration files that specify additional data collection points for ML feature extraction. Configuration includes detailed file integrity monitoring rules, enhanced Windows event log collection, comprehensive network connection monitoring, and process execution tracking with command-line arguments and parent-child relationships. Agent configuration files specify custom log formats for ML processing, enhanced data collection intervals for time-sensitive analysis, and intelligent filtering rules that reduce data volume while preserving critical security information. The enhanced agents maintain compatibility with the existing Wazuh infrastructure while providing enriched data for ML analysis. **Rule Enhancement and Feature Extraction:** Custom Wazuh rules extract structured features from raw security events, including temporal patterns (hour of day, day of week, time since last similar event), event characteristics (severity level, event type, source system type), user and process information (user account, process name, command line arguments), and network information (source/destination IPs, ports, protocols). Rule configuration includes custom decoders for specific log formats, enhanced correlation rules that link related events across time windows, and feature extraction rules that compute statistical measures for ML input. The enhanced rules maintain compatibility with existing Wazuh rulesets while providing structured data output for ML processing;  
**Stage 2: Machine Learning Processing and Enhancement:** The second stage implements our comprehensive ML pipeline with parallel processing for multiple algorithms and ensemble decision-making capabilities. The ML enhancement layer processes structured alert data from Stage 1 through feature extraction, model inference, confidence scoring, and result integration with existing alert workflows. **ML Pipeline Architecture:** The ML processing pipeline implements a modular architecture with separate components for feature preprocessing, model inference, ensemble decision-making, and result formatting. Each component operates independently with well-defined interfaces, enabling flexible algorithm selection and optimization based on organizational requirements. Feature preprocessing includes normalization and scaling of numerical features, encoding of categorical variables, temporal feature extraction from timestamp data, and statistical aggregation of related events. Model inference supports parallel processing of multiple algorithms with intelligent load balancing and resource allocation based on algorithm computational requirements. **Integration API and Data Flow:** The integration between Wazuh and ML processing uses a lightweight RESTful API that ensures minimal latency overhead while providing comprehensive monitoring and error handling. The API implements intelligent caching mechanisms for frequently detected patterns and adaptive prioritization based on threat severity and organizational context. Data flow optimization includes asynchronous processing for non-critical events, priority queuing for high-severity alerts, and automatic failover to rule-based detection in case of ML system unavailability. The integration maintains comprehensive audit logging of all ML decisions and processing times for performance monitoring and troubleshooting. Figure 2 below shows the integration process. The integration of ML augments Wazuh's alerting mechanism, enhancing security monitoring operations and reducing manual effort and operational inefficiencies in Security Operation Centers (SOCs) [15]. Key areas covered in this paper include  
1. **Data Preparation and Cleansing:** Techniques for transforming raw security event data into structured formats suitable for ML analysis;
2.