Wildbox
Wildbox is a self-hosted, open-source security operations platform for threat monitoring, analysis, and automated response.
What Wildbox is
Wildbox is a self-hosted, open-source security operations platform for threat monitoring, analysis, and automated response. The MIT-licensed project combines threat intelligence, cloud security checks, vulnerability management, and incident-response workflows. It aggregates threat data from more than 50 sources for indicator-of-compromise lookup and enrichment. Its cloud feature scans AWS, Azure, and GCP for misconfigurations and tracks cloud security posture, while its vulnerability tools scan, prioritize, and track CVEs across assets through remediation. YAML-based playbooks support repeatable response workflows. Wildbox uses large language models for threat analysis and report generation, with users bringing their own provider. It includes users, teams, and role-based access through an authenticated API gateway, plus configurable integrations for ticketing, SIEM, notifications, and vulnerability tools. The quick start uses Docker Compose and makes the dashboard available at localhost:3000. API endpoints require a Bearer token; documentation also describes API-key authentication for some services. Production guidance advises replacing default secrets and using HTTPS/TLS for external traffic. The project names organizations, security teams, DevOps and platform teams, and researchers as intended users.
Good
- Open source under the MIT license.
- Aggregates threat data from more than 50 sources.
- Scans AWS, Azure, and GCP for misconfigurations.
- YAML playbooks support automated incident-response workflows.
Watch out
- Users bring their own language-model provider.
- Production guidance calls for replacing default secrets.
- Self-hosted deployment uses Docker Compose in the quick start.
Who it suits
Wildbox suits organizations, security teams, DevOps or platform teams, and researchers seeking self-hosted security operations tools. Users should be prepared to bring their own provider for its language-model analysis features.
Verdict
Wildbox brings threat intelligence, cloud checks, vulnerability tracking, and playbook automation into a self-hosted platform. Its documentation also specifies API authentication and production security steps.
The facts
Each one read from Wildbox's own pages, with the date it was checked.
What it does
- Access control
- The platform provides users, teams, and role-based access control behind an authenticated API gateway.checked 7 Oct 2026
- AI analysis
- Wildbox uses large language models for threat analysis and report generation, with users bringing their own provider.checked 4 Oct 2026
- API
- Wildbox documents REST APIs for its services and describes JSON, CSV, SIEM-feed, and custom-webhook data export options.checked 7 Oct 2026
- API authentication
- The documentation says API endpoints require a Bearer token and also describes API-key authentication for some services.checked 4 Oct 2026
- Automated response
- YAML-based playbooks support repeatable, automated incident response workflows.checked 7 Oct 2026
- Cloud security
- Its cloud security feature scans AWS, Azure, and GCP for misconfigurations and tracks cloud security posture.checked 7 Oct 2026
- Deployment
- The site’s quick-start instructions deploy Wildbox with Docker Compose and make its dashboard available at localhost:3000.checked 7 Oct 2026
- Identity and access
- The platform provides users, teams, and role-based access control behind an authenticated API gateway.checked 4 Oct 2026
- Incident response
- YAML-based playbooks support repeatable automated incident-response workflows.checked 4 Oct 2026
- Integrations
- The homepage says Wildbox has 11 integrated services and can connect cloud accounts, endpoints, and applications; its API reference describes integration management for external systems.checked 7 Oct 2026
- Intended users
- The site names organizations, security teams, DevOps and platform teams, and researchers as intended users.checked 7 Oct 2026
- License
- Wildbox is open source under the MIT license.checked 7 Oct 2026
- LLM analysis
- Wildbox uses large language models for threat analysis and report generation, with the user bringing their own provider.checked 7 Oct 2026
- Product
- Wildbox is a self-hosted, open-source security operations platform for threat monitoring, analysis, and automated response.checked 7 Oct 2026
- Security guidance
- The project security policy advises production users to replace default secrets and use HTTPS/TLS for external traffic.checked 4 Oct 2026
- Security operations
- The docs describe bearer-token and API-key authentication, and say internal microservices communicate through APIs secured with X-Gateway-Secret headers.checked 7 Oct 2026
- Support
- The site directs users to GitHub Discussions for questions and GitHub Issues for bug reports.checked 7 Oct 2026
- Threat intelligence
- Wildbox aggregates threat data from 50+ sources for indicator-of-compromise lookups and enrichment.checked 7 Oct 2026
- Vulnerability management
- Wildbox scans, prioritizes, and tracks CVEs across assets through remediation.checked 7 Oct 2026
Alternatives to Wildbox
- 1
Sumo Logic
Free planWebAPILinuxmacOS7.6Free plan - 2
OpenSOAR
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 3
Tines
Free planWebAPILinuxSelf-hosted7.2Free plan - 4
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month - 5
NetWitness Platform
WebAPILinuxmacOS6.5 - 6
Tracecat
Free planWebAPISelf-hosted6.3Free plan