Series Guide

Wazuh Ansible Series

A Wazuh-by-Ansible implementation track covering deployment, SAML, manager and agent configuration, rule tuning, ClamAV, YARA, index backup automation, and Zeek telemetry integration.

SecurityAnsibleWazuh

This page is the central guide for the Wazuh Ansible Series published on Rio Wiraldhani's Medium.

The series is not about installing Wazuh once and stopping there. It is about turning Wazuh into something repeatable, maintainable, and operationally usable with Ansible as the control layer.

The path starts from deployment, then moves into authentication, configuration management, alert tuning, malware detection, backup automation, and network telemetry. Read in order, it works as one continuous implementation track for building a more production-shaped Wazuh environment.

Series Source

What This Series Actually Covers

This is the implementation path:

  1. Deploy Wazuh with Ansible as the baseline
  2. Add SAML authentication with Keycloak
  3. Manage Wazuh manager configuration declaratively
  4. Standardize Wazuh agent profiles with Ansible
  5. Reduce noise with practical custom rules and suppression
  6. Build a centralized ClamAV database mirror
  7. Enable ClamAV on-access malware blocking
  8. Add scheduled malware scanning with Wazuh correlation
  9. Extend detection with YARA scheduled scans
  10. Automate Wazuh indexer backup to Google Cloud Storage
  11. Add Zeek network telemetry into Wazuh

That sequence matters. Later chapters assume the operational baseline from the earlier ones.

Why This Series Exists

Most Wazuh guides stop at setup. That is the easy part.

The harder part is everything after that:

  • making deployment repeatable
  • keeping configuration controlled
  • integrating identity properly
  • reducing noisy alerts
  • adding malware controls without turning the platform fragile
  • automating backup and retention instead of relying on manual recovery steps

This series focuses on that layer.

Use this page as the reading map. Each part links back to the original Medium article, but the structure here makes the whole track easier to follow as one system instead of disconnected posts.

Published Chapters

Part 1

How to Deploy Wazuh with Ansible

This is the deployment baseline for the rest of the series.

  • Wazuh installation with Ansible
  • repeatable host preparation
  • initial automation structure

Read Part 1 on Medium

Part 2

Integrating Wazuh SAML Authentication with Keycloak

This adds the identity layer and access control foundation.

  • SAML flow for Wazuh
  • Keycloak as IdP
  • authentication integrated into the platform, not bolted on later

Read Part 2 on Medium

Part 3

Managing Wazuh Manager Configuration with Ansible

This chapter moves from installation into configuration discipline.

  • manager configuration as code
  • repeatable rollout
  • lower config drift risk

Read Part 3 on Medium

Part 4

Managing Wazuh Agent Configuration Profiles with Ansible

This extends the same control model to agent-side configuration.

  • profile-based agent configuration
  • inventory-driven rollout
  • cleaner host-level standardization

Read Part 4 on Medium

Part 5

Custom Rules for Alert Suppression That Actually Work

This is where the series starts dealing with alert quality instead of raw alert volume.

  • suppress repetitive noise
  • preserve useful detections
  • write rules that support operations instead of flooding them

Read Part 5 on Medium

Part 6

Building a Centralized ClamAV Database Mirror with Ansible

This adds a cleaner signature distribution model for multi-host environments.

  • central ClamAV update distribution
  • less repeated outbound dependency
  • better control for endpoint malware protection rollout

Read Part 6 on Medium

Part 7

Real-Time Malware Blocking with ClamAV On-Access

This turns the environment from passive monitoring into active endpoint protection.

  • on-access scanning
  • file access interception
  • tradeoffs of real-time malware blocking

Read Part 7 on Medium

Part 8

Scheduled Malware Scanning with ClamAV and Wazuh

This adds periodic scanning to complement real-time coverage.

  • scheduled scan execution
  • Wazuh integration
  • layered malware detection model

Read Part 8 on Medium

Part 9

Custom Malware Detection with YARA Scheduled Scanning

This extends signature-based coverage with custom pattern detection.

  • YARA scheduled scanning
  • custom malware hunting
  • coverage for scripts and suspicious artifacts beyond standard AV signatures

Read Part 9 on Medium

Part 10

Automating Wazuh Indexer Backups to Google Cloud Storage

This closes the loop with retention and recovery discipline.

  • automated snapshot repository setup
  • scheduled backup flow
  • Google Cloud Storage as off-node backup target

Read Part 10 on Medium

Part 11

Zeek Network Telemetry into Wazuh

This extends the series from host telemetry into practical network visibility.

  • install Zeek on selected hosts with Ansible
  • ship Zeek JSON logs through the Wazuh agent
  • promote DNS, HTTP, TLS, SSH, files, weird, reporter, and notice events into custom Wazuh detections

Read Part 11 on Medium

Suggested Reading Order

If you want the shortest path through the series:

  1. Read Part 1 first
  2. Continue through Part 2 to Part 4 for access and configuration control
  3. Read Part 5 before tuning alerts in a real environment
  4. Continue through Part 6 to Part 9 for endpoint malware protection and custom detection
  5. Read Part 10 for backup and retention automation
  6. Finish with Part 11 to add network telemetry into the same Wazuh workflow

Series Status

As of July 3, 2026, this site tracks 11 published parts in the Wazuh Ansible run.

The latest published chapter is Part 11: Zeek Network Telemetry into Wazuh, published on July 2, 2026.