Customer System Monitoring
ServMe IT takes pride in the fact our System Monitoring tools are amongst the best in the world. We are also actively using AI to manage our system monitoring, which means nothing falls through the cracks. Each morning, we have a routine which ensures any issues found in the last 24 hours are actioned. Here’s a blog article showing you just what this looks like.
How We Use Wazuh and AI to Turn 15,000 Security Events Into a Two-Minute Read
Every morning, before most of our clients have opened their laptops, our infrastructure has already logged somewhere upwards of ten thousand security events. SSH scanners probing for weak passwords. Bots poking at old backup files. Routine Windows housekeeping. The occasional real finding buried somewhere in the middle of it all.
The hard part of cybersecurity monitoring was never collecting that data. Tools have been doing that well for years. The hard part is turning it into something a human being can actually read, understand, and act on before their coffee goes cold. That’s the problem we set out to solve with our own infrastructure first, before rolling the same approach out to client environments.
The tool
Wazuh is an open-source security monitoring platform — part SIEM (Security Information and Event Management), part host-based intrusion detection, part vulnerability scanner. It sits as an agent on each server or workstation we manage, watching for things like failed logins, file integrity changes, new vulnerabilities in installed software, and suspicious patterns in web server and system logs. It’s genuinely good at its job.
It’s also, out of the box, extremely noisy. A single day of normal, healthy operation across a handful of servers generates thousands of log lines — most of them routine, a few of them worth a second look, and a rare few that need action today. Reading that raw feed every morning isn’t a sustainable way to run a security practice, for us or for anyone.
Learn more about how
The problem: signal buried in noise
Here’s a taste of what a single 24-hour window can look like, based on a recent report from our own internal infrastructure (server names, IP addresses, and account names below have been changed to generic examples — this isn’t our real network):
- Roughly 4,000 combined SSH login attempts against one server, mostly automated bots trying the
rootaccount or guessing usernames - Over 5,000 hits from web recon bots probing for exposed
.envfiles, old PHP info pages, and backup files - Nearly 800 routine Windows registry and file-integrity events on a single, monitored workstation
- Two newly disclosed CVEs picked up by the vulnerability scanner
- One changed crontab entry, one denied
sudoattempt, and one flagged “bot-like” traffic pattern that turned out to be a monitoring dashboard refreshing itself
None of that is unusual for an internet-facing server in 2026 — background scanning is just the ambient noise of being connected to the internet. But somewhere in a list that long, there might be one line that actually matters. Finding it manually, every single day, doesn’t scale.
The fix: AI as a triage layer, not a replacement for judgment
This is where we layer AI on top of Wazuh, rather than relying on either tool alone. Each morning, an automated process pulls the last 24 hours of Wazuh alerts and runs them through an AI summarization step before a human ever looks at it. The AI’s job isn’t to make security decisions — it’s to do the sorting that would otherwise eat an hour, or more, of an analyst’s morning: grouping related events, recognizing routine patterns (a certificate renewal cron job, a scheduled package update, a dashboard polling its own server), and surfacing anything that breaks that pattern.
The output lands in three tiers:
Urgent — anything that would justify getting a phone call, like a successful unauthorized login, a critical file integrity violation, or a remotely exploitable vulnerability on something internet-facing. On a good day, and most days, this section is empty. That’s the point.
Action — findings worth a human decision, but not a fire drill. Not “nothing happened,” but “someone should look at this and confirm it’s expected.”
Information — the routine background noise, kept visible for anyone who wants it, but explicitly separated so it doesn’t drown out anything that matters.
What an “Action” item actually looks like
To make this concrete, here’s an anonymized excerpt from one of our own daily reports, with real hostnames, IP addresses, and account names swapped for generic examples:
| Time | Host | Finding | Detail |
|---|---|---|---|
| 07:10 | vms.servmeit.co.nz | New CVE detected (High severity) | Vulnerability found in an installed package; requires a local trigger to exploit, not remotely exploitable — added to the patch watch-list rather than treated as urgent |
| 14:11 | vms.servmeit.co.nz | Repeated SSH login attempts using root |
Blocked automatically by server configuration; no successful login |
| 04:35 | vms.servmeit.co.nz | Root’s scheduled-task list was modified | Consistent with a routine certificate renewal job — flagged so a human can confirm it was expected |
| 01:43 | vms.servmeit.co.nz | Denied sudo attempt by a non-admin account |
Access correctly denied by permissions; worth confirming the account itself is still expected to exist |
| 04:48 | vms.servmeit.co.nz | Scanning for exposed backup and config files | 106 probe attempts from roughly a dozen source addresses (e.g. 203.0.113.14, 198.51.100.77); all returned “access denied” — nothing exposed |
And, just as usefully, here’s what the AI correctly filtered out of the urgent conversation: a “high volume of automated-looking requests” alert that traced back to an internal monitoring dashboard on our own network refreshing itself every few seconds — a textbook false positive that a purely rules-based alert would have flagged as suspicious traffic. Recognizing “this is us, doing something normal” is exactly the kind of triage that saves a security team from chasing its own tail.
Check it out our other Blogs
Why this matters for a small or medium business
Most SMBs don’t have — and shouldn’t need — a dedicated security operations team staring at dashboards all day. But “we don’t have a SOC” shouldn’t mean “we don’t know what’s happening on our network.” A daily report that’s genuinely readable in two minutes, that tells you plainly whether anything needs your attention today, and that doesn’t cry wolf over routine background scanning, is the middle ground most businesses actually need.
We built this for our own infrastructure first because we weren’t willing to hand a client something we hadn’t trusted with our own systems. Now that the process has proven itself day after day — catching real findings, correctly ignoring the noise, and staying honest about what it doesn’t know — we’re extending the same Wazuh-plus-AI daily reporting to client environments as part of our managed IT and hosting services.
Every daily report we generate is filed away permanently in our internal knowledge base, so there’s always a full, searchable history to look back on if something needs investigating down the track. Customers don’t need to read a report like this every single day, though — instead, we roll the week’s findings up into a single plain-English summary that’s shared at the end of each week (if you wish), so you get the full picture without the noise.
If you’d like to know what this would look like for your own business — what’s currently scanning your servers, what’s routine, and what actually deserves a phone call — get in touch with ServMe IT.
Find out more
Interestedin hosting your own website?
- Ready to register a domain or set up website and email hosting for your business?
Visit billing.servmeit.co.nz to get started, or contact us if you’d like to discuss your requirements.