Enhancing Threat Hunting in Wazuh through a Hybrid Random Forest Model: A Comparative Study for Reducing MTTD and MTTR in Cybersecurity Operations

The increasing sophistication of cyberattacks demands intelligent, adaptive Intrusion Detection Systems (IDSs) capable of rapid threat detection and response. This study proposes a Hybrid Random Forest (HRF) model integrated with the Wazuh platform to enhance threat hunting by reducing Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR). The model is evaluated on two benchmark datasets, CSE-CIC-IDS2018 and ToN_IoT, using a methodology aligned with state-of-the-art approaches, including data preprocessing, Pearson Correlation Coefficient (PCC)-based feature selection, and Min-Max normalization. The results show high detection accuracies of 99.12% and 99.65% on the respective datasets, with significantly lower inference time compared to deep learning models. Integration with Wazuh enables real-time alerting and automated response, reducing MTTD and MTTR by up to 75% and 65%. A comparative analysis against a hybrid GRU-BiLSTM baseline reveals that while the HRF model achieves slightly lower accuracy on ToN_IoT, it outperforms it on CSE-CIC-IDS2018 and offers superior computational efficiency. This work presents a practical framework for deploying lightweight machine learning models in operational environments, demonstrating that ensemble methods like Random Forest are viable, interpretable, and operationally efficient alternatives to deep learning for proactive cybersecurity operations.