Wazuh
1 post on Wazuh: design decisions and how-to guides from small infrastructure estates run on a very low budget.
- Catalyst 3850: send syslog to a SIEM instead of polling SNMP
Point the switch at the SIEM with logging host, raise the trap level to informational, timestamp with milliseconds, log configuration changes with archive, and let Wazuh decode the rest. Port flaps, LACP changes and failed logins become events next to everything else.