https://blog.nadimjsaliby.com Field notes on DevSecOps and cybersecurity. https://blog.nadimjsaliby.com/posts/wazuh-harbor-registry-supply-chain.html https://blog.nadimjsaliby.com/posts/wazuh-harbor-registry-supply-chain.html Wed, 19 Aug 2026 00:00:00 +0000 A Harbor→Wazuh webhook bridge, a 25-rule supply-chain detection pack with three correlation chains (vulnerable image deployed, unscanned image deployed, already-deployed image found vulnerable), and a Wazuh agent rebuilt from source on Wolfi that scored 0 CVEs against the official manager image's 567. Validated live on Wazuh 4.14.5: 23 of 25 rules fire from one script, 40 alerts. https://blog.nadimjsaliby.com/posts/wazuh-k8s-hardening-multi-framework-compliance.html https://blog.nadimjsaliby.com/posts/wazuh-k8s-hardening-multi-framework-compliance.html Wed, 03 Jun 2026 00:00:00 +0000 An open-source Helm chart that wraps Wazuh agents with Kubernetes-native enforcement: CIS, NIST 800-53, PCI-DSS, HIPAA, SOC2, MITRE ATT&CK runtime detection, admission webhook, and a remediation CronJob: all from one deploy. https://blog.nadimjsaliby.com/posts/wazuh-ebpf-tetragon-kernel-detection.html https://blog.nadimjsaliby.com/posts/wazuh-ebpf-tetragon-kernel-detection.html Tue, 05 May 2026 00:00:00 +0000 A custom Wazuh rule pack and reproducible Docker lab that pairs a stock Wazuh agent with a Tetragon eBPF sidecar to catch what stock Wazuh cannot: short-lived process exec, fileless memfd payloads, sub-second TCP connects, kernel module loads, bpf() syscall use, sensitive-file argv reads, setuid escalation. 1 decoder family, 15 rules, 4 distros, 1.59M events validated. https://blog.nadimjsaliby.com/posts/wazuh-network-shadow-ai-detection.html https://blog.nadimjsaliby.com/posts/wazuh-network-shadow-ai-detection.html Tue, 05 May 2026 00:00:00 +0000 A custom Wazuh rule pack and reproducible Docker lab that catches browser-side shadow AI on developer endpoints: DNS lookups, TLS egress, extension manifests, and native messaging hosts. 4 decoders, 15 rules, MITRE ATT&CK mapped, validated live on Wazuh 4.14.5. https://blog.nadimjsaliby.com/posts/wazuh-rogue-mcp-shadow-ai-detection.html https://blog.nadimjsaliby.com/posts/wazuh-rogue-mcp-shadow-ai-detection.html Wed, 29 Apr 2026 00:00:00 +0000 A custom Wazuh rule pack and reproducible Docker lab that catches rogue MCP servers, shadow AI agent activity, and indirect prompt-injection chains on engineering endpoints. 6 decoders, 17 rules, MITRE ATT&CK mapped, validated live on Wazuh 4.14.5. https://blog.nadimjsaliby.com/posts/wazuh-alerts-disappear-after-migration.html https://blog.nadimjsaliby.com/posts/wazuh-alerts-disappear-after-migration.html Wed, 25 Feb 2026 00:00:00 +0000 What caused historical alerts to disappear from Wazuh dashboards after migration, and the safer reindex workflow that fixed it.