Deterministic heuristics
Rules and severity mappings provide repeatable results and allow the service to operate without an external model.
SOC automation · Backend & DevOps · Aug–Dec 2025
AI-powered alert prioritization for Wazuh
A Python service that collects Wazuh alerts, enriches and correlates events, combines heuristic scoring with optional LLM analysis, and forwards high-priority cases to external workflows.
RoleBackend & DevOps Engineer
SourcePublic repository
APIFlask in public build
RuntimeLocal or Docker
01 / Problem
SOC queues need context, consistency, and restraint.
Wazuh can surface large numbers of alerts that vary in severity, repeat the same activity, or lack enough context for quick review. The project explores how automation can reduce repetitive analyst work while keeping a deterministic path available when an LLM is disabled or inappropriate.
Evidence line
The page describes capabilities visible in the public source and my role recorded in the CV. No unmeasured claim about triage-time reduction or production readiness is made.
02 / Architecture
A modular pipeline instead of a black-box score.
Wazuh API→Collector→Normalize + enrich→Heuristic / LLM analyzer→Correlate + prioritize→Webhook / Telegram
The collector supports cursor-based pagination and real-time polling. Alerts are normalized before analysis, then deduplicated, enriched, correlated, and labeled with priority and false-positive risk. High-priority output can feed a webhook or an n8n workflow.
LLM-assisted context
Model output supplements rather than replaces the baseline. The design keeps the integration optional and isolates data handling before the call.
03 / Safety controls
Automation designed around analyst trust.
- PII redaction before alert content is sent to an optional external LLM.
- Deterministic deduplication to reduce repeat processing and notification noise.
- Event enrichment and correlation to retain explainable context around a score.
- False-positive risk labeling to surface uncertainty instead of hiding it.
- JSON logging, health checks, and readiness checks for operational visibility.
- Configuration-driven external integrations so credentials stay outside source code.
04 / Contribution
Backend processing and deployable workflows.
My recorded contribution covered the Python security-event service, alert classification for SQL injection, XSS, brute force, LFI, and DoS patterns, event correlation, and Telegram notification for high-severity incidents. I also worked on the deployment path and operational interfaces.
Consistency note
An earlier CV description names FastAPI; the current public repository implements the API service with Flask. This portfolio uses the verifiable public implementation and labels it accordingly.
05 / Validation
Test the pipeline at its boundaries.
The repository includes automated tests alongside Docker configuration. The service exposes health and readiness endpoints, produces structured logs, and can run without optional LLM or workflow integrations—useful properties for isolating failures during development.
| Boundary | Failure to consider | Design response |
|---|---|---|
| Wazuh collection | Repeated or missed pages | Cursor tracking and deterministic deduplication |
| External LLM | Unavailable service or sensitive input | Optional integration, PII redaction, heuristic fallback |
| Alert scoring | High score without context | Enrichment, correlation, and risk labels |
| Deployment | Process running but not ready | Separate health/readiness signals and JSON logs |
06 / Lessons
What this demonstrates.
AI is most useful in a SOC pipeline when it is bounded by explicit data handling, observable fallbacks, and analyst-readable context. This project strengthened my backend engineering, SIEM integration, security automation, and threat-detection thinking while reinforcing that evaluation must come before efficiency claims.
A future evaluation would compare precision, analyst agreement, triage time, and cost across heuristic-only, LLM-only, and fused configurations on a labeled alert set.
Back to the beginning