Security event collection (Wazuh + OpenCTI)

Set up Wazuh event collection integrated with external threat intelligence, with results surfaced in Grafana.

Track
Security
Status
In use
Period
2023-09 – present
AI
—

My scope

Build and integration.

Approach

  • Wazuh collects host events, OpenCTI brings in external threat data, results feed Grafana.

Architecture and process

Architecture and process details cannot be disclosed under my employment confidentiality terms.

Verification

Event collection runs continuously.

Results

MetricValueSourceEvidence
Related hours181.5 hTimesheetsSystem record
Logged hours split: me / AI executionme ≈165 h, AI execution ≈16 h (hours before 2025-02-22 count as mine)Own estimate; hours since 2025-02-22 split by the period’s ratio; company-logged hours onlyOwn estimate

Limits and next steps

My scope covered event collection and threat-intel integration; downstream analysis and response are outside this case.

Tools

  • Wazuh
  • OpenCTI
  • Grafana