NeetroX AI Agents for SOC Teams

Self-hosted AI agents for SOC teams, built on n8n. Ask about alerts, hosts and threat intel in chat and get sourced answers. Nothing changes without your click.

The agents

• Wazuh Copilot: An AI SOC analyst that watches Wazuh and answers you in chat ($99.99)
• Incident Response Commander: Your AI incident lead in chat, from the first alert to the post-incident report ($99.99)
• Threat Hunter: Hunts your Wazuh data for the attackers your alerts missed ($99.99)
• Phishing Analyst: Checks every reported email, finds out who clicked and thanks the reporter ($99.99)
• Threat Intel Analyst: Tells you if an IP, domain or hash is bad, and whether it already touched your network ($99.99)
• Detection Engineer: Tunes your noisy Wazuh rules and writes new ones, tested before they go live ($99.99)
• Vulnerability Manager: Turns thousands of Wazuh CVEs into a short, prioritized patch list ($99.99)
• Compliance Auditor: Shows where you stand on PCI DSS, ISO 27001, SOC 2 and more, from evidence Wazuh already collects ($99.99)
• SOC Manager: Writes the shift handover, tracks what is overdue and shows where you are blind ($99.99)
• Platform Engineer: Keeps Wazuh healthy, so your security never goes blind without you knowing ($99.99)

A workflow follows steps. An agent answers questions

• How it starts: workflow, A trigger or a schedule; AI agent, A question in chat
• What it does: workflow, The same steps, in the same order; AI agent, Picks the tools the question needs
• Best for: workflow, Triage pipelines, enrichment at volume, reports; AI agent, Investigations, one-off questions, the morning check
• Changes it can make: workflow, Whatever you wired it to do; AI agent, Only what you approve in chat, like blocking an IP or opening a case

The rules every NeetroX agent follows

• Nothing without your click: Agents investigate and report. Any action, from opening a case to blocking an IP, waits for your Approve
• Answers you can trace: Facts come from tool results, and session logs show every call behind an answer
• Self-hosted: They run on your own infrastructure, next to your SIEM, with the AI model you choose
• Tested on a live SOC: Each agent is built and run against real alerts before it is sold

Common questions

What is the difference between an AI agent and a workflow?

A workflow runs the same steps every time it is triggered. An agent takes a question in plain English, decides which tools it needs, calls them and replies. Use workflows for work that repeats, and agents for the questions nobody scripted

Can an agent change anything in my environment?

Not on their own. NeetroX agents search, enrich and report. An action, like blocking an IP or opening a case, runs only after someone on your team clicks Approve

What do I need to run them?

A self-hosted n8n, an AI model and API access to the tools each agent reads. Each agent page lists exactly what it needs

Will there be more agents?

Yes. New agents are added to this page and to the AI Agents menu as they ship. Join the newsletter to hear about the next one first