A SIEM without operations is a log warehouse. Wazuh makes sense when the agent sits on the host, rules match your stack and on-call knows what to do with an alert at a given level. Overview shows agents, the last day and modules: file change, configuration checks, vulnerabilities and compliance.
Agents and an alert owner
We deploy agents where production and data live: the store, the gateway, the database, the admin host. File integrity on configuration and store directories. Compliance checks with a backlog and a change window. Correlation with attack tactics says whether this is noise or something to escalate.
An alert without an owner comes back. That is why the playbook has: who looks, what threshold, what trail stays in the ticket. PCI DSS and GDPR in the dashboard are evidence of control, provided a failed check has a close date.
One picture of the incident
Wazuh does not replace a vulnerability scan or the edge. OpenVAS feeds gaps. Cloudflare holds exposure. Wazuh composes signal from host and application so on-call sees one incident, not five consoles. The full layout is on security and hardening.
In short: the console makes sense when an alert has an owner and a close date. A pile of logs by itself defends nothing.