There's a specific vacuum in Ukrainian DevSecOps. English content is everywhere, Russian resources are walled off (good riddance), and there's almost no Ukrainian-language material on Wazuh, detection engineering or PKI. A few scattered Telegram notes, a couple of articles on DOU, but nothing systematic and nothing with worked examples.

For a while I googled all of this myself, dug through docs and forums, made my own mistakes. Now I want to write down what I learn: how I set things up, what breaks, how it gets fixed. Not because I know everything. Because writing it down and explaining it is the best way to actually understand it myself.

This blog is that place to write it down.

01 Where I'm writing from

I do SIEM engineering at a fintech: a Wazuh manager on a Hetzner VPS, Ansible playbooks for deploying agents and configs, AWS logs in the pipeline, compliance requirements as the backdrop to everyday work. Before that I was a sysadmin, which is where most of my Linux and networking background comes from.

On the side I'm building my own lab: Elastic Security 9 next to Wazuh, my first k8s cluster on RKE2, Vault for PKI and secrets, n8n for automation. The lab is where I can break anything and no client calls at two in the morning.

DevSecOps isn't a buzzword for me, it's a concrete direction: how to build security into a CI/CD pipeline so it doesn't get in the way of deploys but does the opposite. It gives you confidence that what ships to production is what you expect. Ansible runs through all of it, from provisioning to agent configuration to secret rotation.

I'm not writing from a place of "I know everything." I'm writing as an engineer who solves concrete problems every day and wants the next person with the same problem to spend less time on it.

02 Who it's for

Junior+ engineers who need more than a two-sentence "what is SIEM." They want to see how it actually works, with config examples and error walkthroughs.

DevOps engineers looking toward security. People who aren't scared of Ansible and Terraform anymore, but for whom Wazuh or detection engineering is terra incognita. They have a big advantage: they already think about infrastructure systematically. What's left is to add the security context.

Anyone tired of reading vendor docs where everything looks simple, until in practice authd_pass won't generate, the agent won't register, and you're two more hours deep in the logs.

If you're already Senior and know Wazuh like the back of your hand, there might not be much new here. But if you recognized yourself in even one of the three descriptions above, welcome: this is for you.

03 What topics to expect

Three main areas that most of the material will revolve around.

Wazuh and detection engineering. How to set up the manager, how to write custom correlation rules, how to plug in custom decoders, how to read alerts and tell a real incident from a false positive. I'm also planning a series on the first 10 correlation rules worth writing yourself, because Wazuh's default rules are a start, not a finish.

CI/CD and DevSecOps. How to make the pipeline check images, configs and secrets itself before code reaches production. SAST, container scanning, secrets detection: not theory, but concrete steps in GitHub Actions or GitLab CI.

PKI and Vault. Vault as the hub for certificates and secrets: how to stand up a PKI backend, how to automate rotation with Ansible, how to keep Vault from becoming a single point of failure. A topic where the documentation exists, but practical Ukrainian-language examples are close to zero.

The split is roughly 70% fundamentals. "What is SIEM," "how to deploy Wazuh from scratch on Hetzner," "first steps with Ansible Vault." The kind of material you can actually start from. The other 30% is deep-dives from production: cases where something went wrong and had to be figured out.

Ansible runs through all three areas as the connecting tool: deploying agents, managing configs, automating PKI, CI/CD integration. If you don't know Ansible yet, that's on the plan too.

04 Formats

Four main ones: tutorial, deep-dive, postmortem and comparison.

Tutorial. Step by step, with real commands and configs, always with an explanation of what each option actually does, not just "copy and run."

Deep-dive. When there's a specific topic worth taking apart in detail, like how Wazuh processes logs, from agent collection to an alert in the dashboard. Fewer of these, but longer.

Postmortem. A breakdown of what didn't work and why. I think this is the kind of material you learn from fastest. Someone already stepped on that rake, so better to read about it than repeat it.

Comparison. Comparing approaches or tools. Not "X is better than Y," but "here's the problem, here's why I picked X, here's what it gave me and what it didn't."

Cadence: one full post a week is the ceiling, not the target. If more happens, good. If not, I'd rather skip a week than publish something half-baked. I'm not planning to burn out on content.

The canonical version is always here, on the blog. The Telegram channel @shumops gets a teaser and a link. Worth following if you want to hear about new posts first, and there are Telegram notes between posts too.

05 How you can help

If there's a topic that's personally bugging you, drop it in the comments or write to me directly. I can't promise I'll cover everything at once, but a specific request really does shift the order.

If a post turned out useful, share it in a relevant chat or with a colleague who needs it right now. That's the best support for a young blog with no ad budget.

If you find a mistake, technical or grammatical, tell me. Better to fix it than leave it.