Threat-Hunting on imsjhttps://imsj-blog.pages.dev/tags/threat-hunting/Recent content in Threat-Hunting on imsjHugoenMon, 10 Aug 2026 00:00:00 +0000AI-assisted threat hunting with Wazuh and Claude Codehttps://imsj-blog.pages.dev/posts/ai-assisted-threat-hunting-with-wazuh/Mon, 10 Aug 2026 00:00:00 +0000https://imsj-blog.pages.dev/posts/ai-assisted-threat-hunting-with-wazuh/<p><strong>TL;DR:</strong> Stand up the Wazuh server/indexer/dashboard, enroll agents on every host you care about, then let an AI agent (Claude Code) do the hunting: it queries the Wazuh indexer through the dashboard&rsquo;s search proxy with <code>curl</code>, runs aggregations mapped to MITRE ATT&amp;CK tactics, and triages what&rsquo;s noise vs. what&rsquo;s real. The agent is fast at the mechanical part — pivoting across source IPs, users, FIM changes, process events — so you spend your time on judgement, not query syntax.</p>