<![CDATA[Background: Cyber-attacks continue to grow in volume and sophistication, and small-to-medium organizations are increasingly exposed because of limited budgets and security personnel. Open-source Security Information and Event Management (SIEM) platforms such as Wazuh offer a low-cost alternative to commercial solutions, yet their reliance on static, rule-based correlation logic limits their ability to detect previously unseen or evolving threats and tends to generate a high rate of false positives. Objective: This study evaluates a layered Wazuh pipeline in which DBSCAN supplies density-context features to a Random Forest classifier and MISP provides post-classification IOC enrichment within a controlled AIT-ADS laboratory setting. Methods: The experimental evaluation is conducted using the AIT-ADS dataset, which consists of 423,499 alerts. A within-class blocked temporal split produced 338,799 train set and 84,700 test set. Four strictly causal temporal features were combined with ten row-local features; DBSCAN was fitted only on the train set (ε = 0.466428, min_samples = 5) and added four density-context features, yielding 18 classifier inputs before being cross-checked against MISP indicators of compromise. Results: Experimental results show DBSCAN+Random Forest achieved macro-F1 = 0.2976, balanced accuracy = 0.3747, and MCC = 0.4940. Its binary matrix changed from TP = 84,266, TN = 63, FP = 241, FN = 130 to TP = 84,284, TN = 63, FP = 241, FN = 112 after MISP, a 13.85% FN reduction with no induced FP. XGBoost FN decreased from 72 to 54 (25.00%), but FP increased from 270 to 272. Conclusion: The proposed hybrid pipeline demonstrates that machine-learning-based alert classification can reduce false positives in Wazuh while preserving high threat detection sensitivity. However, the results also show that performance remains uneven across minority attack classes, and the benefits of DBSCAN and MISP depend on data characteristics and IOC coverage. Overall, Random Forest provides a more suitable operational trade-off for reducing alert burden in the evaluated scenario.]]>
