AI-Driven Insider Threat Detection Using Wazuh and Behavioral Analytics: A Modular Approach

Abstract: Insider threats represent a critical challengein modern cybersecurity, ofteneluding traditional defensesduet othe irsubtletyandlegit- imateaccess. ThispaperpresentsanAI-drivende- tectionsystemintegratingtheopen-sourceWazuh SIEM platform with behavioral analytics and machine learning. Leveraging the CERT Insider Threat Dataset and real-time log ingestion, the system employs supervised learning models to identifyanomalousbehavior,assigndynamicrisk scores, and provide actionable alerts. The modular architecture ensures scalability and effective threatvisualization, demonstratingproactive de- tection capabilities with reduced false positives through continuous learning.