That is the point. It gives a one- or two-person team the structure of one: a handover, a queue and service levels

Do I need the other NeetroX agents?

No. On its own it covers Wazuh metrics, agent health and log-source coverage. With other agents installed, it also reads their queues into one view

Are the metrics reliable?

Every count comes from Wazuh or the team tables, and the model only explains them. Proxies are labelled, and missing comparisons are shown as missing

Does it only work in Telegram?

No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in

Which AI model does it need?

An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google

What if it is not for me?

You get a 7-day refund. If it does not fit your SOC, you get your money back

Your morning handover, written before you wake up

It runs the operation: what happened on the last shift, what is overdue, where the SOC is blind, how the numbers trend and what the team should do next

SOC Manager: $99.99, one-time. Product details

Even with good tools, somebody has to run the operation

Before: Nobody is sure what happened overnight
Before: Overdue work is found when someone asks
Before: Offline agents and missing logs go unnoticed
After: A shift handover in your chat every morning
After: One queue, overdue first, with service levels
After: Blind spots named, with what each one costs you

A SOC lead for a one- or two-person team

Shift handover: High and critical alerts since the shift started, what each team opened and closed, what is overdue and which agents dropped off
One queue: Phishing cases, hunt findings, rule changes, patch tasks, intel hits and action items, sorted overdue first
Service levels: Critical 4 h, high 24 h, medium 3 days and low 7 days by default, or your own
SOC metrics: Volume, severity mix, top rules and hosts, noise from the 5 loudest rules, MITRE tactics and throughput vs the last period
Agent health: Agents that are down and for how long, never connected, outdated, or active but silent. Laptops on business hours are not flagged at night
Log-source coverage: Which of 13 source families reach Wazuh, and what each missing one costs you
Action items: Follow-ups with owners, priorities and due dates, so nothing gets lost
Management report: An HTML report with KPIs, trend, queues, the oldest critical items, agent health and risks in plain language

One command, about ten minutes

Install: Run one command on Linux, macOS or Windows. It deploys n8n too if you need it
Connect: Add a Wazuh indexer user, your chat app and an AI model key. A read-only Manager API user adds agent health
Ask: Ask what to deal with first. The daily handover starts the next morning

What you need

n8n: n8n 2.34 or newer with Agents and Data Tables, or let the installer deploy it
Wazuh: Wazuh 4.x with an indexer user for wazuh-alerts-*, and vulnerability states on 4.8+ for the coverage check
Manager API: Optional, read-only, for agent health
Chat app: Telegram, Slack, Discord or Linear. A Telegram bot takes a minute with @BotFather
AI model: An API key from any provider in the n8n Agent model picker

Honest numbers, nothing invented

Read-only. The only data it writes is its own action items

Read-only: It reads Wazuh and the team tables, and writes only its own action items
Honest metrics: Time to close is labelled as coming from the team tables. It never passes a proxy off as MTTR
Missing is missing: A comparison with no data shows as missing, never as +100%
Fail-soft: A queue that is not installed, or an API that is not connected, is reported, never guessed
No duplicates: It checks what is already tracked before it adds a follow-up
Data, not instructions: Alert content and item notes are never treated as commands

What you get

7 tool workflows and the daily handover
The agent with 5 skills: daily handover, backlog review, visibility check, metrics review and management report
One-command installer for Linux, macOS and Windows
Setup guide and example conversations
Single-organization commercial license
7-day money-back guarantee

Common questions

We do not have a SOC: That is the point. It gives a one- or two-person team the structure of one: a handover, a queue and service levels
Do I need the other NeetroX agents?: No. On its own it covers Wazuh metrics, agent health and log-source coverage. With other agents installed, it also reads their queues into one view
Are the metrics reliable?: Every count comes from Wazuh or the team tables, and the model only explains them. Proxies are labelled, and missing comparisons are shown as missing
Can it change anything?: No. It is read-only. The only data it writes is its own action items
Does it only work in Telegram?: No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in
Which AI model does it need?: An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google
What if it is not for me?: You get a 7-day refund. If it does not fit your SOC, you get your money back

All AI agents