An AI SOC analyst that watches Wazuh and answers in your team chat

It checks Wazuh every 5 minutes, pages you only for what matters and investigates when you ask. Every fact comes from a tool result, and nothing is written without your click

Wazuh Copilot: $99.99, one-time. Product details

Wazuh holds every answer, but only if you go looking

• Before: Write a query for every question
• Before: Pivot to VirusTotal and dig through rule XML
• Before: Copy it all into IRIS by hand
• After: The watcher pages you only for what matters
• After: Ask in plain English and get sourced answers
• After: Say "open a case", click Approve, and it exists

Everything a first-line analyst does, in one chat

• The watcher: Checks Wazuh every 5 minutes with no AI and pages you only for new critical alerts, agents going down and successful logins after brute force
• 14 tools: Alerts, agents, vulnerabilities, rules and threat intel, from plain-English questions
• Entity behavior: "Is root acting strange?" compares the last 24 hours with a 30-day baseline
• Threat hunts: 8 sample hunts mapped to MITRE ATT&CK, run on demand
• Safe rule tuning: Noisy rule? It proposes a child rule, and refuses anything that would hide an attacker
• DFIR-IRIS cases from chat: The full case with IOCs and assets, created only after you click Approve
• 7 playbook skills: Brute force, suspicious logins, malware, vulnerabilities, IOCs, evidence packs and rule tuning
• Morning briefing: What fired, what to look at first and which agents are down, every day at 08:00

One command, about ten minutes

1. Install: Run one command on Linux, macOS or Windows. It deploys n8n too if you need it
2. Connect: Add Wazuh, your chat app and the AI model you choose. A free model option lets you test it first
3. Ask: Send your first question in Telegram, Slack, Discord or Linear. The watcher is already checking every 5 minutes

What you need

n8n

Your own n8n, or let the installer deploy one

Wazuh

API access to your Wazuh manager and indexer

Chat app

Telegram, Slack, Discord or Linear, and the channel you want answers in

AI model

The model you choose. A free option works for testing

DFIR-IRIS

Optional, for opening cases from chat

Why you can let it near your SIEM

Built against a live SOC by the team behind NeetroX workflows: 212 units sold to about 112 customers across 11 SOC teams

• No invented data: Every IP, rule ID and CVE in an answer comes from a tool result, never from the model
• No raw queries: Chat text never reaches Wazuh as a raw query
• Private IPs stay private: Internal addresses are never sent to threat-intel services
• One write, behind your click: It reads everything and writes only one thing: an IRIS case, after you click Approve
• Never touches your defenses: It never blocks, isolates or edits rules
• Your infrastructure, your model: It runs on your own servers with the AI model you choose

What you get

• The Copilot agent and the 5-minute watcher
• 14 tools, 7 playbook skills and 8 sample hunts
• One-command installer for Linux, macOS and Windows
• The daily 08:00 morning briefing
• Bonus: a sample hunt library, upgradable to the 59-hunt Scheduled Hunt Queries library
• Bonus: 15% off when you bundle it with any NeetroX workflow
• 7-day money-back guarantee

Common questions

Can Copilot change anything in my Wazuh?

No. It reads everything and writes only one thing: a DFIR-IRIS case, and only after you click Approve. It never blocks, isolates or edits rules

Does the watcher use AI on every check?

No. It checks Wazuh every 5 minutes without AI and pages you only for new critical alerts, agents going down and successful logins after brute force

Where does it run?

On your own infrastructure. One command installs it on Linux, macOS or Windows in about ten minutes, and deploys n8n too if you need it

Which AI model does it need?

The one you choose. A free model option lets you test it before spending anything on AI

Can it make up an IP or a CVE?

Every IP, rule ID and CVE in an answer comes from a tool result, never from the model. Private IPs are never sent to threat-intel services

Does it only work in Telegram?

No. It runs in Telegram, Slack, Discord or Linear, so your team can use the chat it already works in

Can you install it for me?

Yes. Done For You ($129) installs it in your environment, connects your Wazuh and APIs, tests it end to end and includes 30 days of maintenance

Is there a bundle discount?

Yes. You get 15% off when you bundle it with any NeetroX workflow

What if it is not for me?

You get a 7-day refund. If it does not fit your SOC, you get your money back

All AI agents