← Security Shallots overview
02 / Detection engineering

Reputation changes the meaning of a log.

An internal connection, failed login, or encrypted-DNS event may be noise alone. Joined with reputation and neighboring events, it can become a review-worthy pattern.

SIGNAL A

SIEM telemetry

Wazuh provides the initial event stream and host context.

SIGNAL B

Reputation

VirusTotal scores and abuse.ch / URLhaus feeds add external context to public indicators.

SIGNAL C

Relationships

Shared source host, timing, behavior, and related vulnerability/exploit evidence form a cluster.

OUTPUT

Review priority

The system raises significance while retaining suppressions for ordinary LAN noise.

The missed-signal problem

A reputation hit is not automatically an incident. A brute-force alert is not automatically compromise. The useful automation is the connective tissue: whether multiple weak indicators point to the same host, destination, or time window.

Vulnerability and exploit correlation

A vulnerable host with active exploitation evidence receives different treatment from an isolated vulnerability record. The dashboard exposes that relationship rather than forcing an analyst to manually join screens.

Guardrail: reputation is evidence, not proof. The system raises review priority and preserves provenance.

What this demonstrates

  • Event-driven automation beyond simple rule matching.
  • Threat-intelligence integration with caching and de-duplication.
  • Risk scoring that respects context and suppressions.
  • Analyst-facing explanations tied to concrete evidence.