# Improving Threat Detection in Wazuh Using Machine Learning Techniques
## 3 Materials and Methods
### Design of ML-SOC Architecture and Integration
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Objective Requirement** & **Goal** & **Specific Requirements** \\ \hline \multirow{6}{*}{Advanced Threat Detection identifying anomalies.} & \multirow{6}{*}{Create an ML-SOC capable of accurately detecting threats and identifying anomalies.} & Train ML models on both historical data (archived logs and alerts, e.g., from the alerts;json dataset, capturing past patterns of malicious behavior) and real-time data (incoming logs and alerts processed live by Wazuh agents to detect ongoing threats) to identify malicious behavior. & \multirow{6}{*}{Train ML models on both historical data (archived logs and alerts, e.g., from the alerts;json dataset, capturing past patterns of malicious behavior) and real-time data (incoming logs and alerts processed live by Wazuh agents to detect ongoing threats) to identify malicious behavior.} & \multirow{6}{*}{Train ML models on both historical data (archived logs and alerts, e.g., from the alerts;json dataset, capturing past patterns of malicious behavior) and real-time data (incoming logs and alerts processed live by Wazuh agents to detect ongoing threats) to identify malicious behavior.} & \multirow{6}{*}{Train ML models on both historical data (archived logs and alerts, e.g., from the alerts;json dataset, capturing past patterns of malicious behavior) and real-time data (incoming logs and alerts processed live by Wazuh agents to detect ongoing threats) to identify malicious behavior.} & \multirow{6}{*}{Include mechanisms that provide clear reasoning for triggered alerts.} & \multirow{6}{*}{Include mechanisms that provide clear reasoning for triggered alerts.} \\ \cline{1-1}  & & & \\ \cline{1-1}  & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Requirements and Objectives for ML-SOC Design. Figure 2: ML Integration process. data for ML processing, enhanced memory allocation for high-volume processing, and optimized rule evaluation engines that reduce processing overhead by 25% compared to standard configurations. The enhanced manager maintains full compatibility with existing Wazuh agents and rules while providing structured data output for ML analysis. **Wazuh Indexer Optimization:** The Wazuh Indexer receives specialized mapping templates for ML feature vectors, optimized shard allocation for time-series security data, and enhanced query performance configurations for real-time ML inference. Index lifecycle management policies ensure efficient storage utilization while maintaining rapid access to recent security events required for ML model training and inference. Custom analyzers process security event text for feature extraction, specialized aggregation pipelines compute statistical features for ML input, and optimized cluster configuration supports high-throughput ML workloads. Performance testing demonstrates a 40% improvement in query response times for ML feature extraction compared to standard Wazuh configurations. **Wazuh Dashboard Integration:** The Wazuh Dashboard receives comprehensive enhancements to display ML-generated insights alongside traditional security event analysis. Custom visualizations provide ML model confidence scores, feature importance analysis, and trend detection capabilities that enable SOC analysts to understand and validate ML-generated alerts. Dashboard enhancements include real-time ML performance monitoring widgets, interactive feature importance visualization, and customizable alert prioritization based on ML confidence scores. The integrated dashboard provides comprehensive situational awareness, combining traditional rule-based detection with advanced ML insights. The two-stage processing architecture implementation includes the following:  
**Stage 1: Enhanced Rule-Based Processing and Data Extraction**: The first stage extends traditional Wazuh functionality with enhanced data collection and preprocessing capabilities while maintaining full backward compatibility with existing SOC workflows.