Data analysis components

Security analytics involves collecting, aggregating, and analyzing digital data across an IT environment to detect, investigate, and mitigate cyber threats. Wazuh delivers security analytics through two data analysis components: the normalization engine and the detection engine. In Wazuh, the normalization engine prepares and enriches incoming events, and the detection engine evaluates those normalized events to identify threats and suspicious activity.

Wazuh security analytics policies are managed through the Ruleset Management dashboard. This centralized interface allows users to configure and operate all elements of the data analysis workflow. From the dashboard, users can create and manage decoders, KVDBs, detectors, and detection rules that define how events are parsed, enriched, correlated, and analyzed.

The following sections describe the main components of the Wazuh Ruleset Management dashboard and explain their roles in the data analysis workflow.