# Improving Threat Detection in Wazuh Using Machine Learning Techniques  
[PERSON]  
1 LaSTI Laboratory, ENSA Khouribga, Sultan Moulay Slimane University, Beni Mellal 23000, Morocco, n.gherab@usms. This leads to frequent false alarms that overwhelm security analysts and contribute to alert fatigue, diverting attention from genuine threats. Furthermore, Wazuh lacks adaptive learning capabilities, preventing it from refining its detection strategies based on historical data or evolving attack patterns. The system's performance may also degrade under high data volumes, especially in large-scale enterprise deployments, due to limited optimization for real-time event processing and correlation. To address these limitations, this research proposes the integration of machine learning (ML) into Wazuh's detection architecture. ML models offer several advantages over static rule-based systems: they can learn behavioral patterns from historical data, detect previously unknown attack vectors, and continuously adapt to evolving threats with minimal manual intervention. Supervised learning models such as Random Forest (RF) offer high classification accuracy, while unsupervised models like DBSCAN excel at anomaly detection in unlabeled datasets. These techniques enable multidimensional correlation of events in real time, supporting a more nuanced and efficient threat-detection process. In this study, we present a hybrid ML-enhanced Wazuh framework that integrates supervised and unsupervised learning models into the Wazuh-SIEM pipeline. Our solution includes the deployment of Wazuh agents across monitored endpoints to collect real-time event data, centralized log processing via the Elastic Stack, and ML-based classification using models such as RF, DBSCAN, and others. Alerts are enriched, analyzed, and visualized through Kibana, with real-time inference achieving an average latency of 45 ms, well below the operational threshold of 100 ms required for critical threat response. Figure 1 illustrates the proposed architecture. To operationalize this framework, alerts are first collected from sources, including host-based intrusion detection (HIDS), network intrusion detection (NIDS via Suricata), and application logs. These are formatted as JSON and stored in alerts.json. Filebeat forwards these alerts to Logstash for enrichment, and then Elasticsearch indexes them for real-time querying. Our ML engine interfaces with Elasticsearch to perform feature extraction and classification, optimizing threat detection without disrupting Wazuh's core functionalities. Figure 1: The proposed integration Architecture based on Machine Learning. Despite its robust capabilities, Wazuh presents certain limitations when used as a standalone threat detection system. These limitations are not inherent deficiencies but rather natural constraints of rule-based approaches that justify the integration of machine learning capabilities. High Rate of False Positives: The rule-based approach can often lead to a significant number of false positives, requiring extensive manual validation. This limitation stems from the static nature of predefined rules that cannot adapt to contextual variations in normal network environments. **Limited Real-Time Learning:** Wazuh lacks the ability to adaptively learn from past data to refine detection strategies autonomously. This limitation prevents the system from evolving with changing threats and automatically improving over time. **Scalability Constraints:** Handling large-scale data in real-time can strain resources, impacting the performance of detection and response processes. This constraint becomes particularly problematic in enterprise environments with high volumes of log data. **Complex Alert Management:** Managing and analyzing numerous alerts can become cumbersome, leading to potential oversight of critical threats. This complexity can result in alert fatigue and reduced efficiency of SOC analysts.