# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 3 Materials and Methods
### Training Unsupervised ML Techniques
The optimization for Wazuh, an open-source platform, addresses the specific needs of small and medium enterprises (SMEs), contrasting with the resource-intensive decision tree approach of [PERSON] et al. [9], which, despite higher reported accuracy (99.7-99.9%), may suffer from overfitting and limited adaptability. [PERSON] et al. [8]'s reinforcement learning model, while innovative for novel attack detection (72%), lacks robustness against zero-day threats due to data dependency, a limitation mitigated in our study through diverse attack simulations (e.g., port scanning, malware execution) as outlined in Section 3.2. Similarly, APIRO [11]'s deep learning approach (91.9% Top-1 accuracy) targets API recommendations rather than broad threat detection, rendering it less relevant to our SOC-focused objectives. DeOr [10]'s ontology-based ML, while structured, exhibits scalability constraints with large log volumes, a challenge our Wazuh-integrated solution addresses through Elasticsearch and real-time API processing. This comparison underscores the practical advantages of our hybrid methodology for enhancing Wazuh's threat detection capabilities in resource-constrained environments. ## 5 Conclusions

This research demonstrates the integration of machine learning techniques into Wazuh, an open-source SIEM system, to significantly enhance threat detection capabilities within Security Operations Centers (SOCs). By combining Random Forest for supervised classification and DBSCAN for unsupervised anomaly detection, the proposed hybrid approach achieved 97.2% accuracy and a 78% reduction in false positives while maintaining low inference latency suitable for real-time deployment. This study presents a replicable and resource-efficient ML-SOC framework that overcomes the limitations of traditional rule-based detection by embedding machine learning models directly into Wazuh's event analysis pipeline. Comprehensive performance validation, including end-to-end latency measurement and scalability testing, confirmed the system's ability to process up to 500 events per second with sub-100 ms average latency per event. In addition to improved accuracy and efficiency, the framework effectively mitigates the slight increase in false negatives through ensemble modeling, contextual enrichment, and risk-based thresholds, thereby maintaining comprehensive detection coverage. Comparative analysis with existing state-of-the-art solutions demonstrated that the proposed system offers a competitive balance of performance, interpretability, and integration simplicity, making it particularly suitable for resource-constrained SOC environments. Future work will explore the integration of deep learning methods for more sophisticated threat modeling, the incorporation of external threat intelligence to enhance detection accuracy, and the extension of the framework to other open-source SIEM platforms. The potential application of federated learning will also be investigated to enable secure model sharing across organizations without compromising data confidentiality. Overall, this study contributes a practical and scalable solution to the field of cybersecurity, especially for small and medium-sized enterprises that rely on open-source tools to protect their infrastructure effectively. **Author Contributions:** Conceptualization, S.A.C., Y.M., and N.G. ; methodology, S.A.C. Y.M., and M.Z. ; software, S.A.C. ; validation, M.Z., Y.M., and N.G. ; formal analysis, S.A.C. ; investigation, S.A.C. ; resources, S.A.C. ; data curation, S.A.C. and M.Z. ; writing--original draft preparation, S.A.C. and Y.M. ; writing--review and editing, S.A.C., Y.M., M.Z., and N.G. ; visualization, S.A.C. ; supervision, Y.M. and S.A.C. ; project administration, Y.M. ; funding acquisition, M.Z. and Y.M. All authors have read and agreed to the published version of the manuscript. **Funding:** This research received no external funding. **Data Availability Statement:** The dataset is available upon request from the authors.