Enhancing the Actionability of Intrusion Detection Systems Through Explainable Artificial Intelligence: A Case Study in Mitigating False Alerts in Wazuh

Abstract

Intrusion Detection Systems and SIEM platforms such as Wazuh are essential for detecting cyber threats, yet their effectiveness is constrained by high false positive rates and limited interpretability of alert decisions. This study introduces an XAI-enhanced Wazuh framework that shifts the focus from detection accuracy alone to actionable alert explainability, directly addressing the root cause of false positives through interpretable causality. The research adopts an applied mixed-methods approach using a design–implementation–evaluation cycle with Six Sigma integration, combining quantitative validation and analyst-driven qualitative assessment. The framework integrates XAI techniques such as SHAP and LIME into a five-step alert analysis workflow, evaluated using UNSW-NB15 and CIC-IDS2018 datasets within a Wazuh–ELK environment. The proposed approach demonstrates that embedding explainability significantly enhances SOC performance by enabling precise analyst decision-making. Preliminary results indicate a reduction in false positives by 25 to 65 percent and an improvement in Mean Time to Discover by 20 to 40 percent, while maintaining a minimal increase in false negatives. The findings highlight that false alerts are primarily driven by a lack of contextual interpretability rather than detection limitations. By exposing feature-level contributions through the feature vectors and explanation functions, analysts can systematically tune detection rules, reducing alert ambiguity and fatigue. Furthermore, the study establishes a measurable relationship between explainability and operational metrics, bridging a critical gap in existing SIEM research. Integrating XAI into Wazuh transforms alert handling from reactive filtering to informed decision-making, significantly improving the effectiveness and efficiency of security operations.