diff --git a/package/secubox/luci-app-wazuh/htdocs/luci-static/resources/view/wazuh/overview.js b/package/secubox/luci-app-wazuh/htdocs/luci-static/resources/view/wazuh/overview.js
index 24914268..2bcec9dc 100644
--- a/package/secubox/luci-app-wazuh/htdocs/luci-static/resources/view/wazuh/overview.js
+++ b/package/secubox/luci-app-wazuh/htdocs/luci-static/resources/view/wazuh/overview.js
@@ -3,197 +3,252 @@
 'require dom';
 'require poll';
 'require wazuh.api as api';
+'require secubox/kiss-theme';
 
 return view.extend({
-    handleSaveApply: null,
-    handleSave: null,
-    handleReset: null,
+	handleSaveApply: null,
+	handleSave: null,
+	handleReset: null,
 
-    load: function() {
-        return Promise.all([
-            api.getOverview(),
-            api.getAlertSummary(),
-            api.getCrowdSecCorrelation()
-        ]);
-    },
+	load: function() {
+		return Promise.all([
+			api.getOverview(),
+			api.getAlertSummary(),
+			api.getCrowdSecCorrelation()
+		]);
+	},
 
-    render: function(data) {
-        var overview = data[0] || {};
-        var alerts = data[1] || {};
-        var crowdsec = data[2] || {};
+	render: function(data) {
+		var self = this;
+		var overview = data[0] || {};
+		var alerts = data[1] || {};
+		var crowdsec = data[2] || {};
 
-        var view = E('div', { 'class': 'cbi-map' }, [
-            E('h2', {}, _('Wazuh SIEM Dashboard')),
-            E('div', { 'class': 'cbi-map-descr' },
-                _('Security Information and Event Management powered by Wazuh XDR')
-            ),
+		// Determine health status
+		var agentOk = overview.agent && overview.agent.connected;
+		var managerOk = overview.manager && overview.manager.running;
+		var indexerOk = overview.manager && overview.manager.indexer_status === 'green';
+		var crowdsecOk = crowdsec.crowdsec_running;
 
-            // Status Cards Row
-            E('div', { 'class': 'cbi-section', 'style': 'display: flex; flex-wrap: wrap; gap: 1rem;' }, [
-                // Agent Status Card
-                this.renderStatusCard(
-                    'Agent Status',
-                    overview.agent ? (overview.agent.connected ? 'Connected' : (overview.agent.running ? 'Running' : 'Stopped')) : 'Unknown',
-                    overview.agent && overview.agent.connected ? 'success' : (overview.agent && overview.agent.running ? 'warning' : 'danger'),
-                    'Local security agent monitoring this device'
-                ),
+		var content = [
+			// Header
+			E('div', { 'style': 'margin-bottom: 24px;' }, [
+				E('div', { 'style': 'display: flex; align-items: center; gap: 16px; flex-wrap: wrap;' }, [
+					E('h2', { 'style': 'font-size: 24px; font-weight: 700; margin: 0;' }, 'Wazuh SIEM'),
+					KissTheme.badge(managerOk ? 'RUNNING' : 'STOPPED', managerOk ? 'green' : 'red')
+				]),
+				E('p', { 'style': 'color: var(--kiss-muted); margin: 8px 0 0 0;' },
+					'Security Information and Event Management')
+			]),
 
-                // Manager Status Card
-                this.renderStatusCard(
-                    'Manager Status',
-                    overview.manager ? (overview.manager.running ? 'Running' : 'Stopped') : 'Unknown',
-                    overview.manager && overview.manager.running ? 'success' : 'danger',
-                    'Central SIEM manager in LXC container'
-                ),
+			// Navigation tabs
+			this.renderNav('overview'),
 
-                // Indexer Status Card
-                this.renderStatusCard(
-                    'Indexer Health',
-                    overview.manager ? (overview.manager.indexer_status || 'Unknown') : 'Unknown',
-                    overview.manager && overview.manager.indexer_status === 'green' ? 'success' :
-                    (overview.manager && overview.manager.indexer_status === 'yellow' ? 'warning' : 'danger'),
-                    'OpenSearch cluster for alert storage'
-                ),
+			// Stats row
+			E('div', { 'class': 'kiss-grid kiss-grid-4', 'id': 'wazuh-stats', 'style': 'margin: 20px 0;' }, [
+				KissTheme.stat(alerts.critical || 0, 'Critical', this.colors.red),
+				KissTheme.stat(alerts.high || 0, 'High', this.colors.orange),
+				KissTheme.stat(alerts.medium || 0, 'Medium', this.colors.yellow),
+				KissTheme.stat(alerts.total || 0, 'Total Alerts', this.colors.cyan)
+			]),
 
-                // CrowdSec Integration Card
-                this.renderStatusCard(
-                    'CrowdSec Integration',
-                    crowdsec.crowdsec_running ? 'Active' : 'Inactive',
-                    crowdsec.crowdsec_running ? 'success' : 'notice',
-                    crowdsec.active_decisions + ' active ban decisions'
-                )
-            ]),
+			// Two column layout
+			E('div', { 'class': 'kiss-grid kiss-grid-2' }, [
+				// Health Status card
+				KissTheme.card('System Health', this.renderHealth(overview, crowdsec)),
+				// Quick Actions card
+				KissTheme.card('Quick Actions', this.renderActions())
+			]),
 
-            // Alert Summary Section
-            E('div', { 'class': 'cbi-section' }, [
-                E('h3', {}, _('Alert Summary')),
-                E('div', { 'style': 'display: flex; flex-wrap: wrap; gap: 1rem;' }, [
-                    this.renderAlertBadge('Critical', alerts.critical || 0, 'danger'),
-                    this.renderAlertBadge('High', alerts.high || 0, 'warning'),
-                    this.renderAlertBadge('Medium', alerts.medium || 0, 'notice'),
-                    this.renderAlertBadge('Low', alerts.low || 0, 'info'),
-                    this.renderAlertBadge('Total', alerts.total || 0, 'secondary')
-                ])
-            ]),
+			// Security Layers
+			KissTheme.card('Security Layers', this.renderLayers(overview, crowdsec))
+		];
 
-            // Quick Actions Section
-            E('div', { 'class': 'cbi-section' }, [
-                E('h3', {}, _('Quick Actions')),
-                E('div', { 'style': 'display: flex; gap: 1rem; flex-wrap: wrap;' }, [
-                    E('a', {
-                        'href': 'https://wazuh.gk2.secubox.in',
-                        'target': '_blank',
-                        'class': 'btn cbi-button cbi-button-action'
-                    }, _('Open Wazuh Dashboard')),
+		poll.add(L.bind(this.pollData, this), 30);
+		return KissTheme.wrap(content, 'admin/services/wazuh/overview');
+	},
 
-                    E('button', {
-                        'class': 'btn cbi-button cbi-button-apply',
-                        'click': L.bind(this.handleRestartAgent, this)
-                    }, _('Restart Agent')),
+	colors: {
+		green: '#00C853',
+		red: '#FF1744',
+		orange: '#fb923c',
+		yellow: '#fbbf24',
+		cyan: '#22d3ee',
+		muted: '#94a3b8'
+	},
 
-                    E('a', {
-                        'href': L.url('admin/services/wazuh/alerts'),
-                        'class': 'btn cbi-button'
-                    }, _('View Alerts')),
+	renderNav: function(active) {
+		var tabs = [
+			{ name: 'Overview', path: 'admin/services/wazuh/overview' },
+			{ name: 'Alerts', path: 'admin/services/wazuh/alerts' },
+			{ name: 'File Integrity', path: 'admin/services/wazuh/fim' },
+			{ name: 'Agents', path: 'admin/services/wazuh/agents' }
+		];
 
-                    E('a', {
-                        'href': L.url('admin/services/wazuh/fim'),
-                        'class': 'btn cbi-button'
-                    }, _('File Integrity'))
-                ])
-            ]),
+		return E('div', { 'class': 'kiss-tabs' }, tabs.map(function(tab) {
+			var isActive = tab.path.indexOf(active) !== -1;
+			return E('a', {
+				'href': L.url(tab.path),
+				'class': 'kiss-tab' + (isActive ? ' active' : '')
+			}, tab.name);
+		}));
+	},
 
-            // Security Layers Info
-            E('div', { 'class': 'cbi-section' }, [
-                E('h3', {}, _('Security Layers (SysWarden-Inspired)')),
-                E('table', { 'class': 'table' }, [
-                    E('tr', { 'class': 'tr' }, [
-                        E('th', { 'class': 'th' }, _('Layer')),
-                        E('th', { 'class': 'th' }, _('Component')),
-                        E('th', { 'class': 'th' }, _('Function')),
-                        E('th', { 'class': 'th' }, _('Status'))
-                    ]),
-                    E('tr', { 'class': 'tr' }, [
-                        E('td', { 'class': 'td' }, _('Layer 1: Firewall')),
-                        E('td', { 'class': 'td' }, _('Vortex Firewall + nftables')),
-                        E('td', { 'class': 'td' }, _('Kernel-level IP blocking')),
-                        E('td', { 'class': 'td' }, E('span', { 'class': 'badge success' }, _('Active')))
-                    ]),
-                    E('tr', { 'class': 'tr' }, [
-                        E('td', { 'class': 'td' }, _('Layer 2: IPS')),
-                        E('td', { 'class': 'td' }, _('CrowdSec + Bouncer')),
-                        E('td', { 'class': 'td' }, _('Behavior-based threat detection')),
-                        E('td', { 'class': 'td' }, E('span', {
-                            'class': 'badge ' + (crowdsec.crowdsec_running ? 'success' : 'danger')
-                        }, crowdsec.crowdsec_running ? _('Active') : _('Inactive')))
-                    ]),
-                    E('tr', { 'class': 'tr' }, [
-                        E('td', { 'class': 'td' }, _('Layer 3: SIEM/XDR')),
-                        E('td', { 'class': 'td' }, _('Wazuh Manager')),
-                        E('td', { 'class': 'td' }, _('Log analysis, FIM, threat correlation')),
-                        E('td', { 'class': 'td' }, E('span', {
-                            'class': 'badge ' + (overview.manager && overview.manager.running ? 'success' : 'danger')
-                        }, overview.manager && overview.manager.running ? _('Active') : _('Inactive')))
-                    ]),
-                    E('tr', { 'class': 'tr' }, [
-                        E('td', { 'class': 'td' }, _('Layer 4: WAF')),
-                        E('td', { 'class': 'td' }, _('mitmproxy + HAProxy')),
-                        E('td', { 'class': 'td' }, _('Web application firewall')),
-                        E('td', { 'class': 'td' }, E('span', { 'class': 'badge success' }, _('Active')))
-                    ])
-                ])
-            ])
-        ]);
+	renderHealth: function(overview, crowdsec) {
+		var self = this;
+		var items = [
+			{
+				name: 'Wazuh Agent',
+				status: overview.agent && overview.agent.connected ? 'Connected' :
+					(overview.agent && overview.agent.running ? 'Running' : 'Stopped'),
+				ok: overview.agent && overview.agent.connected,
+				desc: 'Local security monitoring'
+			},
+			{
+				name: 'Wazuh Manager',
+				status: overview.manager && overview.manager.running ? 'Running' : 'Stopped',
+				ok: overview.manager && overview.manager.running,
+				desc: 'SIEM server in LXC'
+			},
+			{
+				name: 'Indexer',
+				status: overview.manager ? (overview.manager.indexer_status || 'Unknown') : 'Unknown',
+				ok: overview.manager && overview.manager.indexer_status === 'green',
+				desc: 'OpenSearch cluster'
+			},
+			{
+				name: 'CrowdSec',
+				status: crowdsec.crowdsec_running ? 'Active' : 'Inactive',
+				ok: crowdsec.crowdsec_running,
+				desc: (crowdsec.active_decisions || 0) + ' ban decisions'
+			}
+		];
 
-        // Setup polling for real-time updates
-        poll.add(L.bind(this.pollStatus, this), 30);
+		return E('div', {}, items.map(function(item) {
+			return E('div', {
+				'style': 'display: flex; align-items: center; justify-content: space-between; padding: 12px 0; border-bottom: 1px solid var(--kiss-line);'
+			}, [
+				E('div', {}, [
+					E('div', { 'style': 'font-weight: 600;' }, item.name),
+					E('div', { 'style': 'font-size: 12px; color: var(--kiss-muted);' }, item.desc)
+				]),
+				KissTheme.badge(item.status, item.ok ? 'green' : 'red')
+			]);
+		}));
+	},
 
-        return view;
-    },
+	renderActions: function() {
+		var self = this;
+		return E('div', { 'style': 'display: flex; flex-direction: column; gap: 12px;' }, [
+			E('a', {
+				'href': 'https://wazuh.gk2.secubox.in',
+				'target': '_blank',
+				'class': 'kiss-btn kiss-btn-green',
+				'style': 'text-decoration: none; justify-content: center;'
+			}, '🔗 Open Wazuh Dashboard'),
 
-    renderStatusCard: function(title, status, statusClass, description) {
-        return E('div', {
-            'class': 'cbi-value',
-            'style': 'flex: 1; min-width: 200px; background: var(--background-color-high); padding: 1rem; border-radius: 8px; border-left: 4px solid var(--' + statusClass + '-color, #666);'
-        }, [
-            E('div', { 'style': 'font-weight: bold; margin-bottom: 0.5rem;' }, title),
-            E('div', {
-                'class': 'badge ' + statusClass,
-                'style': 'font-size: 1.2em; padding: 0.3rem 0.6rem;'
-            }, status),
-            E('div', { 'style': 'font-size: 0.85em; color: var(--text-color-low); margin-top: 0.5rem;' }, description)
-        ]);
-    },
+			E('button', {
+				'class': 'kiss-btn kiss-btn-blue',
+				'click': L.bind(this.handleRestartAgent, this)
+			}, '🔄 Restart Agent'),
 
-    renderAlertBadge: function(label, count, badgeClass) {
-        return E('div', {
-            'style': 'text-align: center; padding: 0.5rem 1rem; background: var(--background-color-high); border-radius: 8px; min-width: 80px;'
-        }, [
-            E('div', { 'style': 'font-size: 1.5em; font-weight: bold;' }, String(count)),
-            E('div', { 'class': 'badge ' + badgeClass }, label)
-        ]);
-    },
+			E('a', {
+				'href': L.url('admin/services/wazuh/alerts'),
+				'class': 'kiss-btn',
+				'style': 'text-decoration: none; justify-content: center;'
+			}, '📋 View Alerts'),
 
-    handleRestartAgent: function() {
-        var self = this;
-        return api.restartAgent().then(function(res) {
-            if (res.success) {
-                L.ui.addNotification(null, E('p', _('Wazuh agent restarted successfully')), 'info');
-            } else {
-                L.ui.addNotification(null, E('p', _('Failed to restart agent')), 'error');
-            }
-            return self.load().then(L.bind(self.render, self));
-        });
-    },
+			E('a', {
+				'href': L.url('admin/services/wazuh/fim'),
+				'class': 'kiss-btn',
+				'style': 'text-decoration: none; justify-content: center;'
+			}, '📁 File Integrity')
+		]);
+	},
 
-    pollStatus: function() {
-        return api.getOverview().then(L.bind(function(overview) {
-            // Update status indicators
-            var agentBadge = document.querySelector('.cbi-section .badge');
-            if (agentBadge && overview.agent) {
-                agentBadge.textContent = overview.agent.connected ? 'Connected' :
-                    (overview.agent.running ? 'Running' : 'Stopped');
-            }
-        }, this));
-    }
+	renderLayers: function(overview, crowdsec) {
+		var layers = [
+			{
+				num: 1,
+				name: 'Firewall',
+				component: 'Vortex + nftables',
+				desc: 'Kernel-level IP blocking',
+				ok: true
+			},
+			{
+				num: 2,
+				name: 'IPS',
+				component: 'CrowdSec + Bouncer',
+				desc: 'Behavior-based detection',
+				ok: crowdsec.crowdsec_running
+			},
+			{
+				num: 3,
+				name: 'SIEM/XDR',
+				component: 'Wazuh Manager',
+				desc: 'Log analysis & correlation',
+				ok: overview.manager && overview.manager.running
+			},
+			{
+				num: 4,
+				name: 'WAF',
+				component: 'mitmproxy + HAProxy',
+				desc: 'Web application firewall',
+				ok: true
+			}
+		];
+
+		return E('table', { 'class': 'kiss-table' }, [
+			E('thead', {}, [
+				E('tr', {}, [
+					E('th', {}, 'Layer'),
+					E('th', {}, 'Component'),
+					E('th', {}, 'Function'),
+					E('th', { 'style': 'text-align: right;' }, 'Status')
+				])
+			]),
+			E('tbody', {}, layers.map(function(layer) {
+				return E('tr', {}, [
+					E('td', {}, 'L' + layer.num + ': ' + layer.name),
+					E('td', { 'style': 'font-family: monospace;' }, layer.component),
+					E('td', { 'style': 'color: var(--kiss-muted);' }, layer.desc),
+					E('td', { 'style': 'text-align: right;' },
+						KissTheme.badge(layer.ok ? 'ACTIVE' : 'DOWN', layer.ok ? 'green' : 'red')
+					)
+				]);
+			}))
+		]);
+	},
+
+	handleRestartAgent: function() {
+		return api.restartAgent().then(function(res) {
+			if (res.success) {
+				L.ui.addNotification(null, E('p', 'Wazuh agent restarted successfully'), 'info');
+			} else {
+				L.ui.addNotification(null, E('p', 'Failed to restart agent'), 'error');
+			}
+		});
+	},
+
+	pollData: function() {
+		var self = this;
+		return Promise.all([
+			api.getOverview(),
+			api.getAlertSummary()
+		]).then(function(data) {
+			var overview = data[0] || {};
+			var alerts = data[1] || {};
+
+			// Update stats
+			var statsEl = document.getElementById('wazuh-stats');
+			if (statsEl) {
+				dom.content(statsEl, [
+					KissTheme.stat(alerts.critical || 0, 'Critical', self.colors.red),
+					KissTheme.stat(alerts.high || 0, 'High', self.colors.orange),
+					KissTheme.stat(alerts.medium || 0, 'Medium', self.colors.yellow),
+					KissTheme.stat(alerts.total || 0, 'Total Alerts', self.colors.cyan)
+				]);
+			}
+		});
+	}
 });
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages b/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages
index 42ed0e69..f49e6e14 100644
--- a/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages
+++ b/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages
@@ -23,7 +23,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  Comprehensive authentication and session management with captive portal, OAuth2/OIDC integration, voucher system, and time-based access control
 Filename: luci-app-auth-guardian_0.4.0-r3_all.ipk
-Size: 12394
+Size: 12395
 
 Package: luci-app-backup
 Version: 1.0.0-r1
@@ -47,7 +47,7 @@ Architecture: all
 Installed-Size: 337920
 Description:  Advanced bandwidth management with QoS rules, client quotas, and SQM integration
 Filename: luci-app-bandwidth-manager_0.5.0-r2_all.ipk
-Size: 61687
+Size: 61686
 
 Package: luci-app-cdn-cache
 Version: 0.5.0-r3
@@ -71,7 +71,7 @@ Architecture: all
 Installed-Size: 276480
 Description:  Network Access Control with client monitoring, zone management, captive portal, parental controls, and SMS/email alerts
 Filename: luci-app-client-guardian_0.4.0-r7_all.ipk
-Size: 52686
+Size: 52688
 
 Package: luci-app-cloner
 Version: 1.0.0-r1
@@ -82,7 +82,7 @@ Architecture: all
 Installed-Size: 102400
 Description:  SecuBox cloning station for building and deploying clone images
 Filename: luci-app-cloner_1.0.0-r1_all.ipk
-Size: 19436
+Size: 19431
 
 Package: luci-app-config-advisor
 Version: 1.0.0-r1
@@ -94,7 +94,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  ANSSI CSPN compliance checking and security configuration advisor
 Filename: luci-app-config-advisor_1.0.0-r1_all.ipk
-Size: 8862
+Size: 8858
 
 Package: luci-app-cookie-tracker
 Version: 1.0.0-r1
@@ -105,7 +105,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI Cookie Tracker Dashboard
 Filename: luci-app-cookie-tracker_1.0.0-r1_all.ipk
-Size: 5668
+Size: 5665
 
 Package: luci-app-crowdsec-dashboard
 Version: 0.7.0-r32
@@ -129,7 +129,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI CVE Triage Dashboard
 Filename: luci-app-cve-triage_1.0.0-r1_all.ipk
-Size: 5947
+Size: 5942
 
 Package: luci-app-cyberfeed
 Version: 0.1.1-r1
@@ -141,7 +141,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  Cyberpunk-themed RSS feed aggregator dashboard with social media support
 Filename: luci-app-cyberfeed_0.1.1-r1_all.ipk
-Size: 12887
+Size: 12886
 
 Package: luci-app-device-intel
 Version: 1.0.0-r1
@@ -153,7 +153,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  LuCI SecuBox Device Intelligence
 Filename: luci-app-device-intel_1.0.0-r1_all.ipk
-Size: 12047
+Size: 12053
 
 Package: luci-app-dnsguard
 Version: 1.1.0-r1
@@ -172,7 +172,7 @@ Description:  SecuBox DNS Guard provides privacy-focused DNS management with AI-
  - Real-time alerts and blocklist management
  - Domain analysis with LocalAI integration
 Filename: luci-app-dnsguard_1.1.0-r1_all.ipk
-Size: 12447
+Size: 12449
 
 Package: luci-app-dns-provider
 Version: 1.0.0-r1
@@ -184,7 +184,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI DNS Provider Manager
 Filename: luci-app-dns-provider_1.0.0-r1_all.ipk
-Size: 7167
+Size: 7174
 
 Package: luci-app-domoticz
 Version: 1.0.0-r1
@@ -196,7 +196,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI Domoticz Home Automation Configuration
 Filename: luci-app-domoticz_1.0.0-r1_all.ipk
-Size: 7122
+Size: 7126
 
 Package: luci-app-exposure
 Version: 1.0.0-r3
@@ -208,7 +208,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  LuCI SecuBox Service Exposure Manager
 Filename: luci-app-exposure_1.0.0-r3_all.ipk
-Size: 11701
+Size: 11700
 
 Package: luci-app-gitea
 Version: 1.0.0-r2
@@ -220,7 +220,7 @@ Architecture: all
 Installed-Size: 92160
 Description:  Modern dashboard for Gitea Platform management on OpenWrt
 Filename: luci-app-gitea_1.0.0-r2_all.ipk
-Size: 16621
+Size: 16622
 
 Package: luci-app-glances
 Version: 1.0.0-r2
@@ -232,7 +232,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  Modern dashboard for Glances system monitoring with SecuBox theme
 Filename: luci-app-glances_1.0.0-r2_all.ipk
-Size: 7023
+Size: 7021
 
 Package: luci-app-gotosocial
 Version: 0.1.0-r1
@@ -244,7 +244,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  LuCI app for GoToSocial Fediverse Server
 Filename: luci-app-gotosocial_0.1.0-r1_all.ipk
-Size: 8207
+Size: 8209
 
 Package: luci-app-haproxy
 Version: 1.0.0-r8
@@ -256,7 +256,7 @@ Architecture: all
 Installed-Size: 225280
 Description:  Web interface for managing HAProxy load balancer with vhosts, SSL certificates, and backend routing
 Filename: luci-app-haproxy_1.0.0-r8_all.ipk
-Size: 35344
+Size: 35340
 
 Package: luci-app-hexojs
 Version: 1.0.0-r3
@@ -268,7 +268,7 @@ Architecture: all
 Installed-Size: 194560
 Description:  Modern dashboard for Hexo static site generator on OpenWrt
 Filename: luci-app-hexojs_1.0.0-r3_all.ipk
-Size: 30452
+Size: 30451
 
 Package: luci-app-iot-guard
 Version: 1.0.0-r1
@@ -280,7 +280,7 @@ Architecture: all
 Installed-Size: 61440
 Description:  IoT device isolation and security monitoring interface
 Filename: luci-app-iot-guard_1.0.0-r1_all.ipk
-Size: 10535
+Size: 10537
 
 Package: luci-app-jellyfin
 Version: 1.0.0-r1
@@ -292,7 +292,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  LuCI Jellyfin Media Server Configuration
 Filename: luci-app-jellyfin_1.0.0-r1_all.ipk
-Size: 10486
+Size: 10487
 
 Package: luci-app-jitsi
 Version: 1.0.0-r1
@@ -304,7 +304,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI Jitsi Meet Configuration
 Filename: luci-app-jitsi_1.0.0-r1_all.ipk
-Size: 5173
+Size: 5174
 
 Package: luci-app-ksm-manager
 Version: 0.4.0-r2
@@ -316,7 +316,7 @@ Architecture: all
 Installed-Size: 112640
 Description:  Centralized cryptographic key management with hardware security module (HSM) support for Nitrokey and YubiKey devices. Provides secure key storage, certificate management, SSH key handling, and secret storage with audit logging.
 Filename: luci-app-ksm-manager_0.4.0-r2_all.ipk
-Size: 18777
+Size: 18779
 
 Package: luci-app-localai
 Version: 0.1.0-r15
@@ -328,7 +328,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  Modern dashboard for LocalAI LLM management on OpenWrt
 Filename: luci-app-localai_0.1.0-r15_all.ipk
-Size: 13319
+Size: 13318
 
 Package: luci-app-localrecall
 Version: 1.0.0-r1
@@ -340,7 +340,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI LocalRecall AI Memory Dashboard
 Filename: luci-app-localrecall_1.0.0-r1_all.ipk
-Size: 8418
+Size: 8423
 
 Package: luci-app-lyrion
 Version: 1.0.0-r1
@@ -352,7 +352,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI support for Lyrion Music Server
 Filename: luci-app-lyrion_1.0.0-r1_all.ipk
-Size: 6836
+Size: 6843
 
 Package: luci-app-mac-guardian
 Version: 0.5.0-r1
@@ -364,7 +364,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI MAC Guardian - WiFi MAC Security Monitor
 Filename: luci-app-mac-guardian_0.5.0-r1_all.ipk
-Size: 6668
+Size: 6663
 
 Package: luci-app-magicmirror2
 Version: 0.4.0-r6
@@ -376,7 +376,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  Modern dashboard for MagicMirror2 smart display platform with module manager and SecuBox theme
 Filename: luci-app-magicmirror2_0.4.0-r6_all.ipk
-Size: 12360
+Size: 12357
 
 Package: luci-app-mailinabox
 Version: 1.0.0-r1
@@ -388,7 +388,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI support for Mail-in-a-Box
 Filename: luci-app-mailinabox_1.0.0-r1_all.ipk
-Size: 5487
+Size: 5485
 
 Package: luci-app-mailserver
 Version: 1.0.0-r1
@@ -400,7 +400,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI Mail Server Manager
 Filename: luci-app-mailserver_1.0.0-r1_all.ipk
-Size: 6514
+Size: 6512
 
 Package: luci-app-master-link
 Version: 1.0.0-r1
@@ -412,7 +412,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI SecuBox Master-Link Mesh Management
 Filename: luci-app-master-link_1.0.0-r1_all.ipk
-Size: 6304
+Size: 6306
 
 Package: luci-app-media-flow
 Version: 0.6.4-r1
@@ -448,7 +448,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI support for Metabolizer CMS
 Filename: luci-app-metabolizer_1.0.0-r2_all.ipk
-Size: 4818
+Size: 4823
 
 Package: luci-app-mitmproxy
 Version: 0.5.0-r2
@@ -472,7 +472,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  Web interface for MMPM - MagicMirror Package Manager
 Filename: luci-app-mmpm_0.2.0-r3_all.ipk
-Size: 7973
+Size: 7972
 
 Package: luci-app-mqtt-bridge
 Version: 0.4.0-r4
@@ -508,7 +508,7 @@ Architecture: all
 Installed-Size: 112640
 Description:  Real-time system monitoring dashboard with Netdata integration for OpenWrt
 Filename: luci-app-netdata-dashboard_0.5.0-r2_all.ipk
-Size: 20559
+Size: 20558
 
 Package: luci-app-network-anomaly
 Version: 1.0.0-r1
@@ -520,7 +520,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI Network Anomaly Detection Dashboard
 Filename: luci-app-network-anomaly_1.0.0-r1_all.ipk
-Size: 7647
+Size: 7645
 
 Package: luci-app-network-modes
 Version: 0.5.0-r3
@@ -544,7 +544,7 @@ Architecture: all
 Installed-Size: 81920
 Description:  Unified network services dashboard with DNS/hosts sync, CDN cache control, and WPAD auto-proxy configuration
 Filename: luci-app-network-tweaks_1.0.0-r7_all.ipk
-Size: 15947
+Size: 15945
 
 Package: luci-app-nextcloud
 Version: 1.0.0-r1
@@ -556,7 +556,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI support for Nextcloud
 Filename: luci-app-nextcloud_1.0.0-r1_all.ipk
-Size: 6571
+Size: 6575
 
 Package: luci-app-ollama
 Version: 0.1.0-r1
@@ -568,7 +568,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  Modern dashboard for Ollama LLM management on OpenWrt
 Filename: luci-app-ollama_0.1.0-r1_all.ipk
-Size: 14338
+Size: 14337
 
 Package: luci-app-picobrew
 Version: 1.0.0-r1
@@ -580,7 +580,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  Modern dashboard for PicoBrew Server management on OpenWrt
 Filename: luci-app-picobrew_1.0.0-r1_all.ipk
-Size: 9531
+Size: 9533
 
 Package: luci-app-secubox
 Version: 0.7.1-r4
@@ -592,7 +592,7 @@ Architecture: all
 Installed-Size: 440320
 Description:  Central control hub for all SecuBox modules. Provides unified dashboard, module status, system health monitoring, and quick actions.
 Filename: luci-app-secubox_0.7.1-r4_all.ipk
-Size: 82093
+Size: 82096
 
 Package: luci-app-secubox-admin
 Version: 1.0.0-r19
@@ -603,7 +603,7 @@ Architecture: all
 Installed-Size: 337920
 Description:  Unified admin control center for SecuBox appstore plugins with system monitoring
 Filename: luci-app-secubox-admin_1.0.0-r19_all.ipk
-Size: 58039
+Size: 58042
 
 Package: luci-app-secubox-crowdsec
 Version: 1.0.0-r3
@@ -627,7 +627,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI MirrorNet Dashboard
 Filename: luci-app-secubox-mirror_0.1.0-r1_all.ipk
-Size: 5852
+Size: 5851
 
 Package: luci-app-secubox-netdiag
 Version: 1.0.0-r1
@@ -639,7 +639,7 @@ Architecture: all
 Installed-Size: 81920
 Description:  Real-time DSA switch port statistics, error monitoring, and network health diagnostics
 Filename: luci-app-secubox-netdiag_1.0.0-r1_all.ipk
-Size: 15344
+Size: 15346
 
 Package: luci-app-secubox-netifyd
 Version: 1.2.1-r1
@@ -651,7 +651,7 @@ Architecture: all
 Installed-Size: 194560
 Description:  Complete LuCI interface for netifyd DPI engine with real-time flow monitoring, application detection, network analytics, and flow action plugins
 Filename: luci-app-secubox-netifyd_1.2.1-r1_all.ipk
-Size: 36719
+Size: 36720
 
 Package: luci-app-secubox-p2p
 Version: 0.1.0-r1
@@ -663,7 +663,7 @@ Architecture: all
 Installed-Size: 245760
 Description:  LuCI SecuBox P2P Hub
 Filename: luci-app-secubox-p2p_0.1.0-r1_all.ipk
-Size: 46831
+Size: 46833
 
 Package: luci-app-secubox-portal
 Version: 0.7.0-r3
@@ -675,7 +675,7 @@ Architecture: all
 Installed-Size: 194560
 Description:  Unified entry point for all SecuBox applications with tabbed navigation
 Filename: luci-app-secubox-portal_0.7.0-r3_all.ipk
-Size: 41683
+Size: 41685
 
 Package: luci-app-secubox-security-threats
 Version: 1.0.0-r4
@@ -687,7 +687,7 @@ Architecture: all
 Installed-Size: 61440
 Description:  Unified dashboard integrating netifyd DPI threats with CrowdSec intelligence for real-time threat monitoring and automated blocking
 Filename: luci-app-secubox-security-threats_1.0.0-r4_all.ipk
-Size: 10655
+Size: 10662
 
 Package: luci-app-service-registry
 Version: 1.0.0-r1
@@ -699,7 +699,7 @@ Architecture: all
 Installed-Size: 194560
 Description:  Unified service aggregation with HAProxy vhosts, Tor hidden services, and QR-coded landing page
 Filename: luci-app-service-registry_1.0.0-r1_all.ipk
-Size: 39955
+Size: 39954
 
 Package: luci-app-simplex
 Version: 1.0.0-r1
@@ -711,7 +711,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI SimpleX Chat Server Configuration
 Filename: luci-app-simplex_1.0.0-r1_all.ipk
-Size: 7038
+Size: 7035
 
 Package: luci-app-streamlit
 Version: 1.0.0-r11
@@ -747,7 +747,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  LuCI Threat Analyst Dashboard
 Filename: luci-app-threat-analyst_1.0.0-r1_all.ipk
-Size: 10144
+Size: 10146
 
 Package: luci-app-tor
 Version: 1.0.0-r1
@@ -771,7 +771,7 @@ Architecture: all
 Installed-Size: 122880
 Description:  Modern dashboard for Tor anonymization on OpenWrt
 Filename: luci-app-tor-shield_1.0.0-r10_all.ipk
-Size: 22765
+Size: 22766
 
 Package: luci-app-traffic-shaper
 Version: 0.4.0-r2
@@ -783,7 +783,7 @@ Architecture: all
 Installed-Size: 81920
 Description:  Advanced traffic shaping with TC/CAKE for precise bandwidth control
 Filename: luci-app-traffic-shaper_0.4.0-r2_all.ipk
-Size: 14589
+Size: 14588
 
 Package: luci-app-vhost-manager
 Version: 0.5.0-r5
@@ -795,7 +795,7 @@ Architecture: all
 Installed-Size: 153600
 Description:  Nginx reverse proxy manager with Let's Encrypt SSL certificates, authentication, and WebSocket support
 Filename: luci-app-vhost-manager_0.5.0-r5_all.ipk
-Size: 26278
+Size: 26285
 
 Package: luci-app-vortex-dns
 Version: 1.0.0-r1
@@ -807,7 +807,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI Vortex DNS Dashboard
 Filename: luci-app-vortex-dns_1.0.0-r1_all.ipk
-Size: 6076
+Size: 6075
 
 Package: luci-app-vortex-firewall
 Version: 1.0.0-r1
@@ -819,7 +819,18 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI Vortex DNS Firewall Dashboard
 Filename: luci-app-vortex-firewall_1.0.0-r1_all.ipk
-Size: 5454
+Size: 5452
+
+Package: luci-app-wazuh
+Version: 1.0.0-r1
+Depends: luci-base, secubox-app-wazuh
+Section: luci
+Maintainer: OpenWrt LuCI community
+Architecture: all
+Installed-Size: 71680
+Description:  Unified security monitoring dashboard for Wazuh SIEM/XDR integration
+Filename: luci-app-wazuh_1.0.0-r1_all.ipk
+Size: 11072
 
 Package: luci-app-wireguard-dashboard
 Version: 0.7.0-r5
@@ -831,7 +842,7 @@ Architecture: all
 Installed-Size: 215040
 Description:  Modern dashboard for WireGuard VPN monitoring on OpenWrt
 Filename: luci-app-wireguard-dashboard_0.7.0-r5_all.ipk
-Size: 42289
+Size: 42290
 
 Package: luci-app-zigbee2mqtt
 Version: 1.0.0-r2
@@ -843,7 +854,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  Graphical interface for managing the Zigbee2MQTT LXC application.
 Filename: luci-app-zigbee2mqtt_1.0.0-r2_all.ipk
-Size: 6595
+Size: 6596
 
 Package: luci-theme-secubox
 Version: 0.4.7-r1
@@ -866,7 +877,7 @@ Installed-Size: 92160
 Description:  Command line helper for SecuBox App Store manifests. Installs /usr/sbin/secubox-app
  and ships the default manifests under /usr/share/secubox/plugins/.
 Filename: secubox-app_1.0.0-r2_all.ipk
-Size: 11179
+Size: 11184
 
 Package: secubox-app-adguardhome
 Version: 1.0.0-r2
@@ -880,7 +891,7 @@ Description:  Installer, configuration, and service manager for running AdGuard
  inside Docker on SecuBox-powered OpenWrt systems. Network-wide ad blocker
  with DNS-over-HTTPS/TLS support and detailed analytics.
 Filename: secubox-app-adguardhome_1.0.0-r2_all.ipk
-Size: 2876
+Size: 2881
 
 Package: secubox-app-auth-logger
 Version: 1.2.2-r1
@@ -898,7 +909,7 @@ Description:  Logs authentication failures from LuCI/rpcd and Dropbear SSH
  - JavaScript hook to intercept login failures
  - CrowdSec parser and bruteforce scenario
 Filename: secubox-app-auth-logger_1.2.2-r1_all.ipk
-Size: 9376
+Size: 9379
 
 Package: secubox-app-crowdsec-custom
 Version: 1.1.0-r1
@@ -923,7 +934,7 @@ Description:  Custom CrowdSec configurations for SecuBox web interface protectio
  - Insider WAF: LAN threat detection (C2, exfiltration, lateral movement)
  - Whitelist for trusted networks
 Filename: secubox-app-crowdsec-custom_1.1.0-r1_all.ipk
-Size: 6934
+Size: 6942
 
 Package: secubox-app-cs-firewall-bouncer
 Version: 0.0.31-r4
@@ -964,7 +975,7 @@ Description:  Cyberpunk-themed RSS feed aggregator for OpenWrt/SecuBox.
  Features emoji injection, neon styling, and RSS-Bridge support
  for social media feeds (Facebook, Twitter, Mastodon).
 Filename: secubox-app-cyberfeed_0.2.1-r1_all.ipk
-Size: 12450
+Size: 12452
 
 Package: secubox-app-device-intel
 Version: 1.0.0-r1
@@ -978,7 +989,7 @@ Description:  Unified device inventory aggregating mac-guardian, client-guardian
  P2P mesh, and exposure scanner data. Includes heuristic classification
  and pluggable emulator modules for MQTT, Zigbee, and USB devices.
 Filename: secubox-app-device-intel_1.0.0-r1_all.ipk
-Size: 13103
+Size: 13104
 
 Package: secubox-app-dns-provider
 Version: 1.0.0-r1
@@ -992,7 +1003,7 @@ Description:  Programmatic DNS record management via provider APIs (OVH, Gandi
  Cloudflare). Provides the dnsctl CLI for record CRUD, zone sync
  DNS propagation verification, and ACME DNS-01 challenge support.
 Filename: secubox-app-dns-provider_1.0.0-r1_all.ipk
-Size: 8254
+Size: 8258
 
 Package: secubox-app-domoticz
 Version: 1.0.0-r4
@@ -1005,7 +1016,7 @@ Installed-Size: 30720
 Description:  Installer, configuration, and service manager for running Domoticz
  inside an LXC Alpine container on SecuBox-powered OpenWrt systems.
 Filename: secubox-app-domoticz_1.0.0-r4_all.ipk
-Size: 7511
+Size: 7512
 
 Package: secubox-app-exposure
 Version: 1.0.0-r1
@@ -1020,7 +1031,7 @@ Description:  Unified service exposure manager for SecuBox.
  - Dynamic Tor hidden service management
  - HAProxy SSL reverse proxy configuration
 Filename: secubox-app-exposure_1.0.0-r1_all.ipk
-Size: 9148
+Size: 9147
 
 Package: secubox-app-gitea
 Version: 1.0.0-r5
@@ -1043,7 +1054,7 @@ Description:  Gitea Git Platform - Self-hosted lightweight Git service
  Runs in LXC container with Alpine Linux.
  Configure in /etc/config/gitea.
 Filename: secubox-app-gitea_1.0.0-r5_all.ipk
-Size: 9442
+Size: 9443
 
 Package: secubox-app-gk2hub
 Version: 0.1.0-r1
@@ -1057,7 +1068,7 @@ Description:  Dynamic landing page generator for GK2 SecuBox services.
  Aggregates Streamlit apps, MetaBlogizer sites, and infrastructure
  services into a single service directory page.
 Filename: secubox-app-gk2hub_0.1.0-r1_all.ipk
-Size: 4053
+Size: 4058
 
 Package: secubox-app-glances
 Version: 1.0.0-r1
@@ -1080,7 +1091,7 @@ Description:  Glances - Cross-platform system monitoring tool for SecuBox.
  Runs in LXC container for isolation and security.
  Configure in /etc/config/glances.
 Filename: secubox-app-glances_1.0.0-r1_all.ipk
-Size: 6141
+Size: 6137
 
 Package: secubox-app-guacamole
 Version: 1.0.0-r1
@@ -1094,7 +1105,7 @@ Description:  Apache Guacamole clientless remote desktop gateway.
  Runs in an LXC Debian container with guacd and Tomcat.
  Supports SSH, VNC, and RDP connections via web browser.
 Filename: secubox-app-guacamole_1.0.0-r1_all.ipk
-Size: 6942
+Size: 6945
 
 Package: secubox-app-haproxy
 Version: 1.0.0-r24
@@ -1114,7 +1125,7 @@ Description:  HAProxy load balancer and reverse proxy running in an LXC containe
  - Stats dashboard
  - Rate limiting and ACLs
 Filename: secubox-app-haproxy_1.0.0-r24_all.ipk
-Size: 22009
+Size: 22010
 
 Package: secubox-app-hexojs
 Version: 1.0.0-r8
@@ -1151,7 +1162,7 @@ Installed-Size: 20480
 Description:  Jellyfin media server running in LXC container.
  Free media server for streaming movies, TV shows, music, and photos.
 Filename: secubox-app-jellyfin_3.0.0-r1_all.ipk
-Size: 4755
+Size: 4753
 
 Package: secubox-app-jitsi
 Version: 1.0.0-r1
@@ -1176,7 +1187,7 @@ Description:  Jitsi Meet - Secure, fully featured video conferencing for SecuBox
  Integrates with HAProxy for SSL termination.
  Configure in /etc/config/jitsi.
 Filename: secubox-app-jitsi_1.0.0-r1_all.ipk
-Size: 8924
+Size: 8922
 
 Package: secubox-app-localai
 Version: 3.9.0-r1
@@ -1198,7 +1209,7 @@ Description:  LocalAI native binary package for OpenWrt.
  
  API: http://<router-ip>:8081/v1
 Filename: secubox-app-localai_3.9.0-r1_all.ipk
-Size: 5850
+Size: 5838
 
 Package: secubox-app-localai-wb
 Version: 2.25.0-r1
@@ -1222,7 +1233,7 @@ Description:  LocalAI native binary package for OpenWrt.
  
  API: http://<router-ip>:8080/v1
 Filename: secubox-app-localai-wb_2.25.0-r1_all.ipk
-Size: 7948
+Size: 7952
 
 Package: secubox-app-lyrion
 Version: 2.0.2-r1
@@ -1257,7 +1268,7 @@ Description:  WiFi MAC address security monitor for SecuBox.
  and spoofing. Integrates with CrowdSec and provides
  real-time hostapd hotplug detection.
 Filename: secubox-app-mac-guardian_0.5.0-r1_all.ipk
-Size: 12096
+Size: 12097
 
 Package: secubox-app-magicmirror2
 Version: 0.4.0-r8
@@ -1279,7 +1290,7 @@ Description:  MagicMirror² - Open source modular smart mirror platform for Secu
  Runs in LXC container for isolation and security.
  Configure in /etc/config/magicmirror2.
 Filename: secubox-app-magicmirror2_0.4.0-r8_all.ipk
-Size: 9251
+Size: 9253
 
 Package: secubox-app-mailinabox
 Version: 2.0.0-r1
@@ -1304,7 +1315,7 @@ Description:  Complete email server solution using docker-mailserver for SecuBox
  
  Commands: mailinaboxctl --help
 Filename: secubox-app-mailinabox_2.0.0-r1_all.ipk
-Size: 7569
+Size: 7571
 
 Package: secubox-app-metabolizer
 Version: 1.0.0-r3
@@ -1325,7 +1336,7 @@ Description:  Metabolizer Blog Pipeline - Integrated CMS with Git-based workflow
  
  Pipeline: Edit in Streamlit -> Push to Gitea -> Build with Hexo -> Publish
 Filename: secubox-app-metabolizer_1.0.0-r3_all.ipk
-Size: 13977
+Size: 13982
 
 Package: secubox-app-mitmproxy
 Version: 0.5.0-r19
@@ -1352,7 +1363,7 @@ Description:  mitmproxy - Interactive HTTPS proxy for SecuBox-powered OpenWrt sy
  Runs in LXC container for isolation and security.
  Configure in /etc/config/mitmproxy.
 Filename: secubox-app-mitmproxy_0.5.0-r19_all.ipk
-Size: 22956
+Size: 22951
 
 Package: secubox-app-mmpm
 Version: 0.2.0-r5
@@ -1373,7 +1384,7 @@ Description:  MMPM (MagicMirror Package Manager) for SecuBox.
  
  Runs inside the MagicMirror2 LXC container.
 Filename: secubox-app-mmpm_0.2.0-r5_all.ipk
-Size: 3978
+Size: 3977
 
 Package: secubox-app-nextcloud
 Version: 1.0.0-r2
@@ -1409,7 +1420,7 @@ Description:  Ollama - Simple local LLM runtime for SecuBox-powered OpenWrt syst
  Runs in Docker/Podman container.
  Configure in /etc/config/ollama.
 Filename: secubox-app-ollama_0.1.0-r1_all.ipk
-Size: 5735
+Size: 5742
 
 Package: secubox-app-picobrew
 Version: 1.0.0-r7
@@ -1431,7 +1442,7 @@ Description:  PicoBrew Server - Self-hosted brewing controller for PicoBrew devi
  Runs in LXC container with Python/Flask backend.
  Configure in /etc/config/picobrew.
 Filename: secubox-app-picobrew_1.0.0-r7_all.ipk
-Size: 5540
+Size: 5538
 
 Package: secubox-app-rustdesk
 Version: 1.0.0-r1
@@ -1444,7 +1455,7 @@ Installed-Size: 20480
 Description:  Self-hosted RustDesk relay server for remote desktop access.
  Downloads and manages hbbs (ID server) and hbbr (relay server) binaries.
 Filename: secubox-app-rustdesk_1.0.0-r1_all.ipk
-Size: 4469
+Size: 4462
 
 Package: secubox-app-simplex
 Version: 1.0.0-r1
@@ -1468,7 +1479,7 @@ Description:  SimpleX Chat self-hosted messaging infrastructure for SecuBox.
  Privacy-first messaging relay that you control.
  Configure in /etc/config/simplex.
 Filename: secubox-app-simplex_1.0.0-r1_all.ipk
-Size: 9368
+Size: 9371
 
 Package: secubox-app-smbfs
 Version: 1.0.0-r1
@@ -1482,7 +1493,7 @@ Description:  SMB/CIFS remote directory mount manager for SecuBox. Manages share
  network mounts for media servers (Jellyfin, Lyrion), backups, and
  general-purpose remote storage over SMB/CIFS protocol.
 Filename: secubox-app-smbfs_1.0.0-r1_all.ipk
-Size: 5271
+Size: 5265
 
 Package: secubox-app-streamlit
 Version: 1.0.0-r5
@@ -1509,7 +1520,7 @@ Description:  Streamlit App Platform - Self-hosted Python data app platform
  
  Configure in /etc/config/streamlit.
 Filename: secubox-app-streamlit_1.0.0-r5_all.ipk
-Size: 16515
+Size: 16514
 
 Package: secubox-app-tor
 Version: 1.0.0-r1
@@ -1532,7 +1543,7 @@ Description:  SecuBox Tor Shield - One-click Tor anonymization for OpenWrt
  
  Configure in /etc/config/tor-shield.
 Filename: secubox-app-tor_1.0.0-r1_all.ipk
-Size: 7368
+Size: 7366
 
 Package: secubox-app-webapp
 Version: 1.5.0-r7
@@ -1550,7 +1561,7 @@ Description:  SecuBox Control Center Dashboard - A web-based dashboard for monit
  - Service management
  - Network interface control
 Filename: secubox-app-webapp_1.5.0-r7_all.ipk
-Size: 39177
+Size: 39172
 
 Package: secubox-app-zigbee2mqtt
 Version: 1.0.0-r3
@@ -1563,7 +1574,7 @@ Installed-Size: 20480
 Description:  Installer, configuration, and service manager for running Zigbee2MQTT
  inside an Alpine LXC container on SecuBox-powered OpenWrt systems.
 Filename: secubox-app-zigbee2mqtt_1.0.0-r3_all.ipk
-Size: 5544
+Size: 5537
 
 Package: secubox-config-advisor
 Version: 0.1.0-r1
@@ -1582,7 +1593,7 @@ Description:  AI-powered configuration security advisor for SecuBox.
  - LocalAI integration for intelligent analysis
  - Automated remediation suggestions
 Filename: secubox-config-advisor_0.1.0-r1_all.ipk
-Size: 14851
+Size: 14849
 
 Package: secubox-content-pkg
 Version: 1.0.0-r1
@@ -1595,7 +1606,7 @@ Installed-Size: 20480
 Description:  Package Metablogizer sites and Streamlit apps as IPKs for P2P distribution.
  Auto-publishes content to the mesh feed for peer auto-sync.
 Filename: secubox-content-pkg_1.0.0-r1_all.ipk
-Size: 3909
+Size: 3910
 
 Package: secubox-cookie-tracker
 Version: 1.0.0-r1
@@ -1618,7 +1629,7 @@ Description:  Cookie Tracker for SecuBox InterceptoR.
  
  Works with secubox-app-mitmproxy for transparent interception.
 Filename: secubox-cookie-tracker_1.0.0-r1_all.ipk
-Size: 10643
+Size: 10647
 
 Package: secubox-core
 Version: 0.10.0-r16
@@ -1638,7 +1649,7 @@ Description:  SecuBox Core Framework provides the foundational infrastructure fo
  - Unified CLI interface
  - ubus RPC backend
 Filename: secubox-core_0.10.0-r16_all.ipk
-Size: 123046
+Size: 123052
 
 Package: secubox-cve-triage
 Version: 1.0.0-r1
@@ -1658,7 +1669,7 @@ Description:  AI-powered CVE analysis and vulnerability management agent for Sec
  - Approval workflow for patch recommendations
  - LXC and Docker package monitoring
 Filename: secubox-cve-triage_1.0.0-r1_all.ipk
-Size: 11827
+Size: 11829
 
 Package: secubox-dns-guard
 Version: 1.0.0-r1
@@ -1677,7 +1688,7 @@ Description:  SecuBox DNS Guard provides AI-powered DNS anomaly detection using
  - Unusual TLD pattern detection
  - Automatic blocklist generation with approval workflow
 Filename: secubox-dns-guard_1.0.0-r1_all.ipk
-Size: 12482
+Size: 12488
 
 Package: secubox-identity
 Version: 0.1.0-r1
@@ -1696,7 +1707,7 @@ Description:  Decentralized identity management for SecuBox mesh nodes.
  - Peer identity verification
  - Trust scoring integration
 Filename: secubox-identity_0.1.0-r1_all.ipk
-Size: 8087
+Size: 8094
 
 Package: secubox-iot-guard
 Version: 1.0.0-r1
@@ -1712,7 +1723,7 @@ Description:  IoT device isolation, classification, and security monitoring.
  risk scoring. Orchestrates Client Guardian, MAC Guardian
  Vortex Firewall, and Bandwidth Manager for IoT protection.
 Filename: secubox-iot-guard_1.0.0-r1_all.ipk
-Size: 13367
+Size: 13372
 
 Package: secubox-localrecall
 Version: 1.0.0-r1
@@ -1727,7 +1738,7 @@ Description:  Persistent memory system for SecuBox AI agents.
  for context across sessions. LocalAI integration for
  semantic search and AI-powered summarization.
 Filename: secubox-localrecall_1.0.0-r1_all.ipk
-Size: 7794
+Size: 7792
 
 Package: secubox-master-link
 Version: 1.0.0-r1
@@ -1749,7 +1760,7 @@ Description:  Secure mesh onboarding for SecuBox nodes via master/peer link.
  
  Configure in /etc/config/master-link.
 Filename: secubox-master-link_1.0.0-r1_all.ipk
-Size: 15040
+Size: 15037
 
 Package: secubox-mcp-server
 Version: 1.0.0-r1
@@ -1777,7 +1788,7 @@ Description:  Model Context Protocol (MCP) server for SecuBox.
  - ai.explain_ban (Explain CrowdSec decisions)
  - ai.security_posture (Security assessment)
 Filename: secubox-mcp-server_1.0.0-r1_all.ipk
-Size: 11430
+Size: 11427
 
 Package: secubox-mirrornet
 Version: 0.1.0-r1
@@ -1795,7 +1806,7 @@ Description:  MirrorNet core mesh orchestration for SecuBox.
  - Mesh health monitoring and anomaly detection
  - DID-based identity (did:plc compatible)
 Filename: secubox-mirrornet_0.1.0-r1_all.ipk
-Size: 15304
+Size: 15302
 
 Package: secubox-network-anomaly
 Version: 1.0.0-r1
@@ -1810,7 +1821,7 @@ Description:  AI-powered network anomaly detection for SecuBox.
  DNS anomalies, and protocol anomalies using statistical
  analysis and optional LocalAI integration.
 Filename: secubox-network-anomaly_1.0.0-r1_all.ipk
-Size: 6169
+Size: 6166
 
 Package: secubox-p2p
 Version: 0.6.0-r3
@@ -1829,7 +1840,7 @@ Description:  SecuBox P2P Hub backend providing peer discovery, mesh networking
  and MirrorBox NetMesh Catalog for cross-chain distributed service
  registry with HAProxy vhost discovery and multi-endpoint access URLs.
 Filename: secubox-p2p_0.6.0-r3_all.ipk
-Size: 47862
+Size: 47859
 
 Package: secubox-p2p-intel
 Version: 0.1.0-r1
@@ -1848,7 +1859,7 @@ Description:  Decentralized threat intelligence sharing for SecuBox mesh.
  - CrowdSec and mitmproxy integration
  - Automatic firewall rule application
 Filename: secubox-p2p-intel_0.1.0-r1_all.ipk
-Size: 9796
+Size: 9800
 
 Package: secubox-threat-analyst
 Version: 1.0.0-r1
@@ -1867,7 +1878,7 @@ Description:  Autonomous threat analysis agent for SecuBox.
  
  Part of SecuBox AI Gateway (Couche 2).
 Filename: secubox-threat-analyst_1.0.0-r1_all.ipk
-Size: 9865
+Size: 9870
 
 Package: secubox-vortex-dns
 Version: 1.0.0-r1
@@ -1886,7 +1897,7 @@ Description:  Meshed multi-dynamic subdomain delegation system for SecuBox.
  - Gossip-based exposure config sync
  - Submastering for nested hierarchies
 Filename: secubox-vortex-dns_1.0.0-r1_all.ipk
-Size: 5442
+Size: 5441
 
 Package: secubox-vortex-firewall
 Version: 1.0.0-r1
@@ -1901,5 +1912,5 @@ Description:  DNS-level threat blocking with x47 impact multiplier.
  any connection is established. Integrates threat feeds from
  abuse.ch, OpenPhish, and local DNS Guard detections.
 Filename: secubox-vortex-firewall_1.0.0-r1_all.ipk
-Size: 8895
+Size: 8899
 
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages.gz b/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages.gz
index 7396df81..ee278c2e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages.gz and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages.gz differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-wazuh_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-wazuh_1.0.0-r1_all.ipk
new file mode 100644
index 00000000..09ac7d6c
Binary files /dev/null and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-wazuh_1.0.0-r1_all.ipk differ