Wazuh users can now integrate an LLM assistant to simplify security event analysis. By leveraging OpenSearch Assistant, which is compatible with Wazuh 4.14.7 and OpenSearch 2.19.5, analysts can query security logs using natural language instead of complex query languages.
The integration process involves installing specific plugins, including opensearch-skills and opensearch-flow-framework for the indexer, and assistantDashboards, mlCommonsDashboards, and observabilityDashboards for the interface. The setup requires approximately two hours to complete.
Once configured, the system provides three primary tools: a chat window for direct queries, a Query Assist feature that converts natural language into PPL queries, and an Explain Document button that analyzes alerts and vulnerabilities to provide actionable insights.
The assistant operates by connecting to an OpenAI-compatible API. The indexer uses a connector to communicate with the model, while agents manage prompts and tools, such as PPLTool, to retrieve and interpret data from the Wazuh alerts index.
