Ai on imsj

AI-assisted threat hunting with Wazuh and Claude Code

Mon, 10 Aug 2026 00:00:00 +0000

TL;DR: Stand up the Wazuh server/indexer/dashboard, enroll agents on every host you care about, then let an AI agent (Claude Code) do the hunting: it queries the Wazuh indexer through the dashboard’s search proxy with curl, runs aggregations mapped to MITRE ATT&CK tactics, and triages what’s noise vs. what’s real. The agent is fast at the mechanical part — pivoting across source IPs, users, FIM changes, process events — so you spend your time on judgement, not query syntax.

Control Claude Code with clear boundaries

Sun, 09 Aug 2026 00:00:00 +0000

TL;DR: Set opusplan as your default model, then phrase every task as five things — what you want, what must be preserved, what must not be touched, how to approach it, and what “done” means. You don’t need enormous prompts. You need clear boundaries and a clear definition of done.

Anthropic’s Best practices for Claude Code guide.

Steps

Default to opusplan. Opus thinks and plans, Sonnet writes the code. It’s the single easiest optimisation for larger coding tasks.