I would look at CISA’s Logging Made Easy project, which is based on Wazuh.

github.com/cisagov/LME