The Feasibility of OpenSearch’s Security Analytics with Wazuh

In the context of rapidly advancing cyber threats, ransomware stands out as a particularly destructive challenge that exploits vulnerabilities to significantly disrupt operations. This project explores the feasibility of using OpenSearch’s Security Analytics in conjunction with Wazuh to detect cyberattacks through log data analysis. Various integration methods, including server integration, indexer integration, and direct plugin integration, were tested for its ability to effectively correlate alerts and identify potential ransomware threats in simulated settings. The findings provide essential insights into optimal practices and configurations for using OpenSearch’s Security Analytics to enhance Wazuh’s functionality.