Wazuh Ansible Series Part 6: Building a Centralized ClamAV Database Mirror with Ansible
How I built an internal ClamAV mirror using Nginx to serve virus definitions, cutting 7.2GB/day of redundant egress traffic.
DevOpsSecurityAnsibleWazuh
Writing & analysis
The reasoning behind the systems.
Longer-form writing about operational trade-offs, lessons from implementation, and the decisions that make systems easier to trust.
Filter by category
Read on Medium →
Wazuh Ansible Series Part 5: Custom Rules for Alert Suppression That Actually Work
How I wrote Wazuh suppression rules that silenced 300+ noise alerts per hour after four failed approaches.
WazuhAnsibleSecurityDevOps
Wazuh Ansible Series Part 4: Managing Wazuh Agent Configuration Profiles with Ansible
How I managed different Wazuh agent ossec.conf profiles using inventory-owned files, host variables, and Ansible deployment roles.
WazuhAnsibleDevOpsInfrastructure
Wazuh Ansible Series Part 3: Managing Wazuh Manager Configuration with Ansible
How I managed Wazuh manager ossec.conf using inventory-owned files, local wrapper roles, and a controlled restart flow.
WazuhAnsibleDevOpsSecurity
Wazuh Ansible Series Part 2: Integrating Wazuh SAML Authentication with Keycloak
How I integrated Wazuh with Keycloak using SAML, group-based access, and Wazuh RBAC mapping.
WazuhAnsibleSecurityDevOps
Wazuh Ansible Series Part 1: How to Deploy Wazuh with Ansible
A practical guide to building a maintainable Wazuh deployment repository using upstream roles, wrapper roles, and inventory-driven files.
WazuhAnsibleDevOpsSecurity