Hybrid AI-Powered SOC: Integrating Wazuh SIEM, AWS, and MikroTik with a Local AI Triage Agent

Modern Security Operations Centers (SOCs) managing hybrid environments face three critical operational challenges: 1. Visibility Gaps: On-premises network infrastructure (such as ISP/enterprise MikroTik routers and Windows endpoints) often operates in silos separated from cloud environments (AWS), making multi-stage attack correlation difficult. 2. Tier-1 Alert Fatigue: High-volume perimeter reconnaissance, port scanning, and brute-force attempts generate thousands of daily alerts, overwhelming L1 analysts with repetitive manual log parsing and triage. 3. Compliance vs. Blind Automation Risks: Sending sensitive security telemetry (IPs, usernames, infrastructure logs) to external cloud LLMs violates strict data sovereignty and compliance frameworks (such as ISO 27001 and GDPR). Conversely, relying on blind, fully automated firewall blocking introduces the operational risk of false-positive outages on critical network gateways. This project was initiated to bridge on-premises network administration and cloud security monitoring by engineering a compliant, privacy-first Hybrid AI-SOC that automates L1 forensic investigation locally while keeping final containment decisions under human governance.

I architected, deployed, and documented an end-to-end Hybrid AI-SOC pipeline across cloud and on-premises environments: 1. Hybrid Infrastructure & Encrypted Telemetry: Deployed Wazuh SIEM/XDR on an isolated AWS EC2/VPC environment and established an encrypted OpenVPN tunnel to ingest real-time syslog streams from an on-premises MikroTik RouterOS perimeter router and Windows endpoints, alongside AWS CloudTrail logs for cloud infrastructure auditing. 2. Custom Detection Engineering: Developed custom Wazuh decoders and XML detection rules (Rule IDs 100100–100106) mapped to MITRE ATT&CK tactics to detect SSH/WinBox brute-force attacks, perimeter port scans, unauthorized router configuration changes, and suspicious endpoint behavior. 3. Privacy-First Local AI Agent & Tool-Calling Workflow: Built an autonomous Python AI SOC Agent powered by a locally hosted LLM (Llama-CPU via Ollama) to guarantee Zero Data Leakage. Triggered automatically on high-severity Wazuh alerts (Level 10+), the agent executes a multi-step investigation using custom tools: - Historical Memory Tool (ChromaDB RAG): Queries a local vector database to correlate incoming alerts with past incidents and repeat offenders. - Asset & Context Enrichment Tool: Evaluates target criticality and verifies internal management IP whitelists. - Forensic Triage Analyzer: Assesses attack payloads locally to determine true severity, attack classification, and false-positive probability. - Remediation Payload Generator: Automatically drafts exact MikroTik RouterOS firewall commands (Address List drops) or endpoint isolation scripts. 4. Human-in-the-Loop (HITL) Staged Containment: Engineered a governance workflow where the agent stages the remediation payload for analyst review. Once approved by the human analyst, the command is executed immediately via Wazuh Active Response on the MikroTik firewall with full audit logging.

1. Unified Hybrid Visibility: Successfully centralized real-time threat detection across on-premises MikroTik network perimeters, Windows endpoints, and AWS CloudTrail within a single Wazuh SIEM dashboard. 2. 90% Reduction in L1 Manual Triage: Automated repetitive Tier-1 log correlation, historical lookups, and remediation scripting—reducing Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) from minutes of manual investigation to seconds. 3. 100% Data Sovereignty & Compliance (Zero Data Leakage): Achieved full regulatory compliance by executing all AI reasoning (Ollama/Llama-CPU) and vector similarity searches (ChromaDB) strictly on-premises/in-VPC without exposing sensitive security logs to third-party APIs. 4. Zero False-Positive Outages: Enforcing a Human-in-the-Loop (HITL) staged response mechanism enabled rapid perimeter blocking on MikroTik firewalls upon analyst approval while preventing accidental disruption of legitimate network services.

• Wazuh SIEM
• AWS
• MikroTik RouterOS
• Ollama
• ChromaDB
• Python
• OpenVPN
• CloudTrail
• Incident Response
• SOAR

• GitHub ↗ (opens in a new tab)