Optimizing Threat Detection in a Wazuh SIEM Environment through Custom Rule Development and Tuning

Abstract

Security Information and Event Management (SIEM) platforms are central to modern Security Operations Centers, yet default rule sets often fail to capture the low-level behaviors of emerging Common Vulnerabilities and Exposures (CVEs). This paper presents WAGARD (Wazuh Generative AI Rule Detection), a framework that integrates Wazuh logs with the Llama-3.1-FoundationAI-SecurityLLM-base-8B model to analyze host activity and synthesize custom Wazuh detection rules. The system converts raw archives and audit logs into deduplicated, context-preserving windows, ranks events using a hybrid rarity and expert-salience score, and feeds high-signal payloads to a fine-tuned model for behavioral interpretation. Experiments were conducted on Ubuntu-based virtual machines across ten local privilege escalation and container-escape CVEs. Results show that fine-tuning improves precision and reduces false positives compared with the base Foundation-Sec-8B model. WAGARD also demonstrates a practical rule-management workflow through a Flask dashboard and Wazuh API integration. The findings suggest that LLM-assisted reasoning can shorten the path from log analysis to deployable SIEM logic, while still requiring validation for production safety.