Will this make us compliant?

No tool can. It covers the technical controls, which auditors test hardest, and shows exactly what to fix

Which frameworks does it cover?

PCI DSS, ISO 27001, SOC 2, NIST 800-53, HIPAA, GDPR, CIS Controls, CMMC and the CIS benchmarks, through the mappings in Wazuh SCA

What can I hand the auditor?

An evidence pack per control as a CSV, and a printable HTML audit report clearly scoped to technical controls

How are exceptions handled?

Each accepted risk needs a reason, an approver and an expiry. It leaves the score, shows separately in reports and lapses on its own

Does it only work in Telegram?

No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in

Which AI model does it need?

An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google

What if it is not for me?

You get a 7-day refund. If it does not fit your SOC, you get your money back

Know your audit gaps months before the auditor does

It turns the checks Wazuh already runs into audit answers: where you stand on 9 frameworks, what fails on which hosts, how to fix it and what to show the auditor

Compliance Auditor: $99.99, one-time. Product details

Wazuh already runs the checks. Nobody turns them into audit answers

Before: Thousands of SCA results nobody maps to controls
Before: Evidence gathered by hand the week before
Before: Exceptions with no owner and no end date
After: Each control shown as compliant, partial or failing
After: A fix list ordered by how much each fix moves the score
After: Evidence packs per control, ready for the auditor

A technical gap assessment in an hour, not a week

Posture: SCA scores per host and policy, weakest first, with stale scans, missing results and drift over weeks
Framework status: PCI DSS, ISO 27001, SOC 2, NIST 800-53, HIPAA, GDPR, CIS Controls, CMMC and CIS, control by control
Monitoring evidence: The requirements with Wazuh alerts tagged to them, such as PCI DSS 10.2 logging or SOC 2 CC7
Remediation plan: Failing checks across the fleet, most-failed first, with the exact fix and the controls it maps to
Evidence packs: Everything for one control as a CSV: check results per host, accepted risks, remediation and tagged alerts
Accepted risks: Exceptions with a reason, an approver and an expiry. They leave the scores and lapse on their own
Score history: A nightly snapshot of every score, so drift shows up before the auditor sees it
Weekly check and audit report: Score changes and expiring exceptions every week, plus a printable HTML report scoped to technical controls

One command, about ten minutes

Install: Run one command on Linux, macOS or Windows. It deploys n8n too if you need it
Connect: Add a read-only Wazuh Manager API user for SCA results, an indexer user for alerts, your chat app and an AI model key
Ask: Ask where you stand on your framework. The weekly check starts on its own

What you need

n8n: n8n 2.34 or newer with Agents and Data Tables, or let the installer deploy it
Wazuh SCA: Wazuh 4.x with SCA enabled on the agents, which is the default
Manager API: A read-only user, required for SCA results
Indexer: Read access to wazuh-alerts-* for monitoring evidence
Chat app: Telegram, Slack, Discord or Linear. A Telegram bot takes a minute with @BotFather
AI model: An API key from any provider in the n8n Agent model picker

It speaks the auditor's language, honestly

Technical controls only. It never claims an organization is compliant, and every report says so

Technical scope: It maps host configuration and monitoring to a framework. Policy, process and people controls need their own evidence
No overclaiming: Asked "are we compliant?", it gives the status and the scope, never a yes
Read-only on Wazuh: It reads SCA results and alerts, and writes only its own risk and snapshot tables
Statuses from mappings: Statuses come from SCA results and their mappings, not the model. Unmapped frameworks are reported as such
Accountable exceptions: No exception without a reason and an approver, and every exception expires
Evidence you can trace: Every status leads back to the exact checks and hosts behind it

What you get

6 tool workflows plus the nightly score snapshot
The agent with 5 skills: framework assessment, remediation plan, audit evidence, risk acceptance and weekly check
One-command installer for Linux, macOS and Windows
Setup guide and example conversations
Single-organization commercial license
7-day money-back guarantee

Common questions

Will this make us compliant?: No tool can. It covers the technical controls, which auditors test hardest, and shows exactly what to fix
Which frameworks does it cover?: PCI DSS, ISO 27001, SOC 2, NIST 800-53, HIPAA, GDPR, CIS Controls, CMMC and the CIS benchmarks, through the mappings in Wazuh SCA
What can I hand the auditor?: An evidence pack per control as a CSV, and a printable HTML audit report clearly scoped to technical controls
How are exceptions handled?: Each accepted risk needs a reason, an approver and an expiry. It leaves the score, shows separately in reports and lapses on its own
Does it only work in Telegram?: No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in
Which AI model does it need?: An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google
What if it is not for me?: You get a 7-day refund. If it does not fit your SOC, you get your money back

All AI agents