Is the training Qualiopi certified?

Yes, Learni is a Qualiopi-certified training organization. This certification guarantees the quality of our courses and enables funding through OPCO and other mechanisms.

How can I fund my training?

Our courses are eligible for OPCO funding. Learni supports you through the funding process. A personalized quote is available upon request.

What are the prerequisites for this training?

The prerequisites for the Advanced Wazuh Training - Master Open-Source SIEM and XDR training are: Linux/Unix mastery, SIEM basics, intermediate Wazuh experience, REST API knowledge.. A preliminary interview validates your eligibility.

Is the training available in person?

Yes, the Advanced Wazuh Training - Master Open-Source SIEM and XDR training is available in remote. The format can be adapted to your needs (inter, intra, custom).

Advanced Wazuh Training - Master Open-Source SIE... | Learni

The story of Learni

Founded by passionate advocates of learning and innovation, Learni set out to make professional training accessible to everyone, everywhere in the world. Our team works in the largest cities such as Paris, Lyon, Marseille, and internationally, to support talents and organizations in their skills development.

Configure your training

Response within 24hNo commitment100% free

7 spots remaining for the next session

FormatParticipantsDateDetails

Which format do you prefer?

Methods, approaches, and teaching resources

The Advanced Wazuh Training - Master Open-Source SIEM and XDR training is delivered in-person or remotely (blended-learning, e-learning, virtual classroom, remote in-person). At Learni, a Qualiopi-certified training organization, each program is designed to maximize skills acquisition, regardless of the training mode chosen.

The trainer alternates between demonstrative, interrogative, and active methods (through practical exercises and/or real-world scenarios). This pedagogical approach ensures concrete and directly applicable learning in the workplace.

Teaching resources provided

To ensure the quality of the Advanced Wazuh Training - Master Open-Source SIEM and XDR training, Learni provides the following teaching resources:

Mac or PC computers, high-speed fiber internet, whiteboard or flipchart, video projector or interactive touchscreen (for remote sessions)
Training environments installed on workstations or accessible online
Course materials, practical exercises, and supplementary resources
Post-training access to materials and teaching resources

For in-house training at a location external to Learni, the client ensures and commits to having all necessary teaching materials (IT equipment, internet connection...) for the proper conduct of the training action in accordance with the prerequisites indicated in the communicated training program.

* contact us for remote feasibility** ratio varies depending on the training followed

Assessment methods

The assessment of skills acquired during the Advanced Wazuh Training - Master Open-Source SIEM and XDR training is carried out through:

During training: case studies, practical exercises, and professional scenarios
At the end of training: self-assessment questionnaire and skills evaluation by the trainer
After training: training completion certificate detailing acquired skills

Training accessibility

Learni is committed to the accessibility of its professional training programs. All our training programs are accessible to people with disabilities. Our teams are available to adapt teaching methods to your specific needs. Do not hesitate to contact us for any accommodation request.

Training objectives

Deploy Wazuh in a high-availability cluster

Create advanced custom rules and decoders

Integrate Wazuh with ELK Stack and third-party tools

Analyze threats via dashboards and AI alerts

Automate incident responses with Active Response

Optimize performance for scalable environments

Audit and secure enterprise Wazuh deployments

Training program

Module 1Wazuh Deployment: Cluster and Advanced Agents (Docker, Ansible Tools)

Dive into clustered Wazuh installation via Docker and Ansible, configure multi-platform agents on Linux/Windows, test high availability by simulating failures, generate initial compliance reports, master SSL certificates for enhanced security, and deploy your first reproducible lab environment.

Module 2Custom Rules: Decoders and CDB Lists (Regex, Syscheck Tools)

Create complex decoders with regex for custom logs, develop advanced rules detecting APT and zero-day attacks, integrate CDB lists for dynamic IOCs, practice on real intrusion cases, validate via attack simulations, produce production-ready deliverables that boost detection by 40%.

Module 3Advanced Integrations: API and ELK (Kibana, Filebeat Tools)

Master Wazuh REST API for Python script automations, integrate seamlessly with ELK Stack via Filebeat, customize Kibana dashboards for threat visualizations, test massive log flows, develop SOAR connectors, and deploy enriched pipelines that transform data into actionable insights.

Module 4Threat Analysis: MITRE ATT&CK and Active Response (Ossec-logtest Tools)

Map alerts to the MITRE ATT&CK framework, analyze incidents via Ossec-logtest in real-time, configure Active Response for automatic blocking of malicious IPs, simulate ransomware cyber-attacks, generate response playbooks, and refine correlations to reduce false positives by 60%, ready for production defense.

Module 5Optimization and Audit: Wazuh Scalability (Prometheus, Vulnerability Detector Tools)

Scale Wazuh for 10k+ agents with performance tuning, integrate Vulnerability Detector for CVE scans, monitor via Prometheus/Grafana, audit GDPR/ISO27001 compliance, resolve real bottlenecks, produce a final optimization report, and validate your expertise with an impactful enterprise POC.