The layer that decides what deserves a human.
A security operations platform built on Wazuh. It scores every alert against a transparent model, correlates scattered events into kill-chain incidents, and carries response all the way to the endpoint.
| Time | Alert | Host | Severity | Score |
|---|---|---|---|---|
| 09:52 | Domain admin group modified | DC-01 | critical | 94 |
| 09:31 | SQL injection on web tier | WEB-02 | high | 74 |
| 09:20 | Kerberoast request burst | DC-01 | high | 71 |
| 09:14 | IMAP brute force | MAIL-01 | medium | 58 |
| 08:58 | Port scan from external host | GW-01 | low | 31 |
Counted from the repository. Every screen renders live data — no demo mode, no fixtures.
Detection is solved. Triage is not.
Wazuh detects well and triages badly. It produces thousands of undifferentiated alerts a day, ranked only by a rule severity that knows nothing about which machine was hit, whether the same thing already fired forty times, or whether this event is one step in a longer attack.
Alertio does not replace the detection engine. It sits on top and adds what a rule severity cannot know.
- Transparent scoring
- Four weighted factors with the arithmetic shown per alert, and the weights tunable from the interface.
- Correlation
- Seven patterns, expressed as data rather than code, assembling events into a kill-chain story across six phases.
- Response
- Eight action types, from a one-click block to signed scripts deployed to the fleet.
- One interface
- A single time filter, one severity language, and one table-and-drawer pattern across all twenty-six screens.
A low score is still surfaced when it belongs to an attack.
Seven patterns assemble scattered events into a kill-chain story. Extending the library is authoring, not engineering.
- Threaded by identity, not IP
- An attack that crosses network zones from different vantage points would split into two unrelated incidents under an IP-keyed correlator. Alertio joins on the compromised account.
- Nothing is dropped
- Alerts below the queue gate are suppressed, not deleted. When one turns out to be a step in a longer chain, it is still there to be pulled back in.
- Mapped to ATT&CK
- Techniques map to kill-chain phases, and a coverage matrix shows fourteen tactics and ninety-seven techniques against what the deployment can actually see.
One chained attack across a real segmented network.
Four isolated demonstrations would show four alerts. One chain shows the product. Alertio was run against a lab with a perimeter, a DMZ, a corporate domain and an out-of-band SOC — and a seven-stage intrusion driven through it end to end.
Stage A — Reconnaissance
Scans the public edge for reachable services.
Stage B — Initial access
Exploits the public web application — SQL injection and path traversal.
Stage C — Delivery & credentials
Phishes a finance user, then brute-forces the mailbox.
Stage D — Foothold
Signs in to the domain with the phished finance credentials.
Stage E — Credential access
Password spray and Kerberoast from the compromised workstation.
Stage F — Privilege escalation
Adds the finance account to Domain Admins.
Stage G — Impact
Mass file modification on a monitored share.
Seven events, four sensors, two zones — one incident.
The attack crosses two zones from different vantage points, so the source address changes partway through. A correlator keyed on IP would break the chain in the middle and report two unrelated incidents. Alertio threads it by the compromised account instead — the same identity is phished on the mail server, used to sign in to the domain, and escalated to Domain Admin.
The decision reaches the endpoint.
Eight action types, from a one-click block through multi-step playbooks to authoring, signing and deploying custom response scripts to the fleet.
- Guarded by design
- Every action previews before it executes and requires an explicit acknowledgement. Destructive actions — isolate a host, kill a process, quarantine a file — are restricted to administrators.
- Human-triggered, deliberately
- Playbooks are never fired automatically. The engine supports it; the policy does not. For a platform that can isolate a host, that is a defensible position rather than a missing feature.
- Signed and reconciled
- Custom scripts are validated, packaged into signed bundles and pushed to agents, with a background job polling the manager for true per-target deployment state rather than assuming success.
What Alertio does not do.
A product that hides its limits is harder to trust than one that names them.
- Notifications are in-app
- There is no outbound email, Slack or webhook alerting. Alerts reach analysts inside the interface.
- One organisation per deployment
- Single tenant by design, on SQLite. The repository layer isolates the change when that stops being the right answer.
- The AI is advisory
- Triage verdicts come from a security-tuned language model and are recorded as advice an analyst can override — not a classifier, and not the decision.
- Wazuh is the implemented source
- Integrations sit behind a common interface, but Wazuh is the one that is wired today.
See Alertio against your own environment.
Tell us what you already run for detection and we will tell you what Alertio would add on top of it.