Wazuh Alert Manager: An OpenSearch plugin for alert and case management in Wazuh-based Security Operations Centers

Security analysts using Wazuh for security monitoring typically report experiencing high alert volumes. However, in the Wazuh 4.12-4.14 dashboards considered in this paper, there is no native way to manage the alert lifecycle, analyst workload, handle independent multi-alert cases, or automate alert workflows. As a result, many SOCs running Wazuh add external case management tools like TheHive and DFIR-IRIS, increasing the technology stack and operational complexity. In this paper, we present the Wazuh Alert Manager plugin v2.0.2, built for Wazuh dashboard versions 4.12-4.14, to provide alert and case management, alert workflow automation, and reporting within the Wazuh dashboard. The plugin writes only to its indexes and only performs reads from Wazuh native alert indexes. In three benchmarking tests, the plugin processed 100,000 alerts on a standard all-in-one Wazuh VM with a median time of 238.081 seconds, resulting in exactly 42 cases, 5,000 alert auto-closures, 2,500 auto-assignments, and no actions on 87,200 benign alerts. The plugin is licensed under Apache 2.0 and archived on Zenodo.