Wazuh Mobile Agent Puts a Real SIEM Endpoint on Android

Field notes

The app treats an Android phone as a Wazuh endpoint, using enrollment on port 1515 and encrypted event transport on port 1514 instead of only forwarding log lines. Its collectors cover posture, package changes, connectivity, battery state, notification metadata, and local YARA matches, with each category disabled until enabled. A separate AI Analysis screen retrieves recent manager logs and sends them to Claude in one request; the visitor supplies and pays for the API key directly.