Wazuh 5.0 is in beta: worth a lab test
Wazuh 5.0 betas add a built-in threat-intel (CTI) section, incident response in the dashboard, AI assistant settings, and switch file-integrity who-data to eBPF by default. Manager daemons and config files were reorganized, and legacy OS support was dropped.
Do this now: Stand it up next to your current SIEM in the lab and replay last month's alerts. Don't upgrade production during beta.
Detection idea: watch your DNS servers this month
With a wormable DNS bug patched in September, unpatched DNS servers are an obvious target. Exploitation of server processes usually shows up as crashes and unusual child processes.
Do this now: Alert on dns.exe service crashes/restarts and on any process spawned by dns.exe. Test the alert with a benign child process in the lab.
Log your AI agents like you log your admins
A reported flaw in the official MCP Python SDK let a malicious MCP server capture OAuth credentials. Agent tool calls are becoming a new privileged-access path.
Do this now: Inventory which MCP servers and AI agents can reach your systems, and forward their auth and tool-call logs into the SIEM.