We already have alerts. Why hunt?

Alerts catch what rules already know. Hunting finds the attacker who used a valid password, at a strange hour, on a host nobody watches

Do I need to know a query language?

No. Ask in plain English, by hypothesis, tactic or entity. The agent builds every query from typed filters

Can it change anything in Wazuh?

No. It is read-only on Wazuh. Opening a DFIR-IRIS case is its only outward action, and it waits for your Approve

What if we do not collect much telemetry?

The coverage check shows which hunts can fire with what you have, which are blind and which data source unlocks the most

Does it only work in Telegram?

No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in

Which AI model does it need?

An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google

What if it is not for me?

You get a 7-day refund. If it does not fit your SOC, you get your money back

Find the attackers who got past your alerts

Ask in plain English. It plans the hunt from 59 MITRE ATT&CK hunts, runs it on your Wazuh data, triages what comes back and records every real lead as a finding

Threat Hunter: $99.99, one-time. Product details

Alerts catch what rules already know. Attackers live in the gaps

Before: A valid login at a strange hour raises nothing
Before: Hunting needs query skills and senior time
Before: Nobody knows which hunts are blind
After: Hunt in plain English, by hypothesis, tactic or entity
After: New users, binaries and changed files surfaced every week
After: A coverage check says which hunts can fire and which are blind

A senior threat hunter in your team chat

59-hunt ATT&CK library: 30 Windows, 18 Linux and 11 cross-platform hunts, each with a hypothesis, a threshold, a triage hint and false-positive notes
Many hunts at once: One batch query for any set of hunts, a whole tactic, this week's rotation or all 59
Ad-hoc hunts: Typed filters on rule, technique, host, IP, user, process, command line, file, hash or domain, with optional stacking
Stack counting: Values seen for the first time this week and the rarest ones: new users, binaries, changed files and admin commands
Entity pivots: Everything about one IP, user, host, hash or process, with first and last seen, rules, tactics and related entities
Coverage check: Which telemetry reaches Wazuh, how many hunts can fire, which are blind and what to enable first
Findings journal: Every real lead becomes a finding with severity, ATT&CK ids, entities and a timestamped evidence trail
Weekly sweep: Runs a quarter of the library each week, stack-counts what is new and sends the summary and an HTML report
DFIR-IRIS escalation: A case with the evidence, IOCs and hosts, created only after someone clicks Approve

One command, about ten minutes

Install: Run one command on Linux, macOS or Windows. It deploys n8n too if you need it
Connect: Add a read-only Wazuh indexer user, your chat app and an AI model key. Threat intel and DFIR-IRIS are optional
Hunt: Ask for your first hunt. The weekly sweep runs on the day and time you pick

What you need

n8n: n8n 2.34 or newer with Agents and Data Tables, or let the installer deploy it
Wazuh: Wazuh 4.x with an indexer user that can read wazuh-alerts-*
Chat app: Telegram, Slack, Discord or Linear. A Telegram bot takes a minute with @BotFather
AI model: An API key from any provider in the n8n Agent model picker
Telemetry: More data, more hunts: Windows Security auditing, Sysmon, PowerShell logging, auditd and FIM

Hunts everything, changes nothing

Read-only on Wazuh. The only outward action, opening an IRIS case, waits for a human click

Read-only on Wazuh: The hunter never writes to Wazuh, and the weekly sweep never escalates by itself
Facts come from tools: The model plans, triages and writes. Reports take their facts straight from the findings table
Clean never means blind: The coverage check says when a hunt could not see the data, so silence is never mistaken for safety
No raw queries: Chat text never reaches Wazuh as a raw query. Every filter is a typed clause
Private IPs stay private: Internal addresses are never sent to threat-intel services
Known-good left out: Your office and VPN IPs are excluded from every hunt

What you get

10 tool workflows and the weekly sweep
The agent with 10 hunting skills, from methodology and pivoting to persistence and write-ups
The 59-hunt MITRE ATT&CK library
One-command installer for Linux, macOS and Windows
Setup guide and example conversations
Single-organization commercial license
7-day money-back guarantee

Common questions

We already have alerts. Why hunt?: Alerts catch what rules already know. Hunting finds the attacker who used a valid password, at a strange hour, on a host nobody watches
Do I need to know a query language?: No. Ask in plain English, by hypothesis, tactic or entity. The agent builds every query from typed filters
Can it change anything in Wazuh?: No. It is read-only on Wazuh. Opening a DFIR-IRIS case is its only outward action, and it waits for your Approve
What if we do not collect much telemetry?: The coverage check shows which hunts can fire with what you have, which are blind and which data source unlocks the most
Does it only work in Telegram?: No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in
Which AI model does it need?: An API key from any provider in the n8n Agent model picker, such as Anthropic, OpenAI, OpenRouter or Google
What if it is not for me?: You get a 7-day refund. If it does not fit your SOC, you get your money back

All AI agents