I do not want AI changing my rules

It cannot on its own. It proposes, tests with logtest and waits for your Approve, and any change can be rolled back

Will it hide real attacks to cut noise?

No. Guards written in code refuse to suppress public attacker IPs, privileged logins, rules of level 12 and up, or a whole rule

What if a change breaks the manager?

It validates the configuration before restarting. On any failure it restores the previous file first, so the running manager never changes

Does it touch the stock ruleset?

Never. It writes only to its own rules file, with rule IDs from a range you choose

Does it only work in Telegram?

No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in

Which AI model does it need?

An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google

What if it is not for me?

You get a 7-day refund. If it does not fit your SOC, you get your money back

Cut your Wazuh noise and close the gaps attackers use

It ranks the rules that bury your analysts, proposes safe tuning, writes new detections from a log sample and tests every change with logtest before it goes live

Detection Engineer: $99.99, one-time. Product details

When every rule fires all day, analysts stop reading any of them

Before: A few rules bury everything else
Before: Tuning means XML, logtest and a risky restart
Before: Attacks with no rule go unseen
After: The noisiest rules ranked, with safe tuning proposals
After: New detections written from a real log sample
After: Every change logtested, approved and reversible

Detection engineering without the XML

Finds the noise: Ranks the rules that create the most alerts with a noise score and a tuning hint
Explains any rule: The definition next to what it actually fires on: hosts, source IPs, users, programs and raw logs
Tunes safely: Child rules that suppress one benign source or change a level. Stock rules are never overwritten
Writes new detections: From a real log sample, with parent rules, decoded fields, PCRE2 regex, correlation, level and ATT&CK ids
Tests with logtest: Every change is proven to fire on its sample before it goes live
Applies and rolls back: Backs up, uploads, logtests, validates and restarts. On any failure it restores the previous file first
ATT&CK coverage: Your ruleset against about 46 common techniques: covered and firing, covered but silent, or missing
Measures impact: Alerts per day before and after each change
Weekly review: Ranks the noise, prepares safe proposals and names the top coverage gaps. It never applies anything by itself

One command, about ten minutes

Install: Run one command on Linux, macOS or Windows. It deploys n8n too if you need it
Connect: Add a Wazuh indexer user, a Manager API user that can read rules and run logtest, your chat app and an AI model key
Tune: Ask for the noisiest rules. Changes stay in dry run until you allow real ones

What you need

n8n: n8n 2.34 or newer with Agents and Data Tables, or let the installer deploy it
Indexer: A Wazuh 4.x indexer user with read access to wazuh-alerts-*
Manager API: Reads rules and runs logtest. To apply changes, rule update and manager restart
Chat app: Telegram, Slack, Discord or Linear. A Telegram bot takes a minute with @BotFather
AI model: An API key from any provider in the n8n Agent model picker

It proposes, tests and waits for your yes

Proposals change nothing. Applying or rolling back needs a human Approve, and dry run is on by default

Propose, approve, apply: Applying and rolling back both wait for an Approve click in chat
Dry run by default: Changes are previews only until you allow real ones
Its own file only: It edits only its own rules file, never local_rules.xml or the stock ruleset, with rule IDs from a range you choose
Restored on failure: Logtest on a real sample and config validation before any restart. Any failure restores the previous file
Guards in code: It refuses to hide public attacker IPs, privileged logins, rules of level 12 and up, or a whole rule
No raw queries: Chat text never reaches Wazuh as a raw query. Every filter is a typed clause

What you get

10 tool workflows and the weekly review
The agent with 5 skills: tuning decision, rule writing, coverage gaps, change safety and weekly review
One-command installer for Linux, macOS and Windows
Setup guide and example conversations
Single-organization commercial license
7-day money-back guarantee

Common questions

I do not want AI changing my rules: It cannot on its own. It proposes, tests with logtest and waits for your Approve, and any change can be rolled back
Will it hide real attacks to cut noise?: No. Guards written in code refuse to suppress public attacker IPs, privileged logins, rules of level 12 and up, or a whole rule
What if a change breaks the manager?: It validates the configuration before restarting. On any failure it restores the previous file first, so the running manager never changes
Does it touch the stock ruleset?: Never. It writes only to its own rules file, with rule IDs from a range you choose
Does it only work in Telegram?: No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in
Which AI model does it need?: An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google
What if it is not for me?: You get a 7-day refund. If it does not fit your SOC, you get your money back

All AI agents