An Integrated System for Automated Threat Detection and Response Using Wazuh, Suricata and Telegram

Abstract

The increasing speed and diversity of cyberattacks require security monitoring systems that progress from detection to timely and controlled containment. This study developed an integrated framework that combines Suricata network intrusion detection, Wazuh event correlation and Active Response, and Telegram notification. The framework was implemented in an isolated VirtualBox laboratory using a Kali Linux attacker at 192.168.218.128 and an Ubuntu security host at 192.168.218.132. Five controlled scenarios were evaluated: port scanning, Secure Shell (SSH) brute force, Synchronize (SYN) flood, Structured Query Language (SQL) injection, and reverse shell. A scenario passed only when the correct Wazuh detection, Telegram notification, independently verified automated response, timed removal, and recovery evidence were observed. All five scenario-level tests passed, giving a functional test pass rate of 5/5 under the tested configuration. The mean detection-to-response delay was 0.727 seconds, with a maximum of 2.000 seconds, while the mean recovery time was 61.770 seconds. The principal contribution is an auditable, attack-specific closed loop that links detection, correlation, notification, containment, rollback, and recovery rather than treating alert delivery as evidence of mitigation. Because each scenario was executed once and benign control traffic was not included, the result is proof-of-concept functional validation and not general detection accuracy, reliability, precision, or recall.