Solutions · SOC & CTI teams
Your sensors. Your graph. Your ground.
For a team that wants intelligence about its own attack surface rather than a feed about everyone’s: device-faithful sensors forward of your network, 40+ sources correlated into one scored graph, and enforcement in the formats your stack already speaks, all on hardware you control.
What a small team runs into
Four reasons the free-feeds-in-a-SIEM approach stalls.
Feeds barely overlap
Only a small fraction of indicators appear on a second list. A team wiring three feeds into a SIEM is paying for redundancy and still missing what is aimed at them specifically.
Nothing is aimed at you
Public intelligence describes the world. It does not tell you what is knocking on your perimeter tonight, from which ASN, with which tooling.
Enforcement is a copy-paste job
An indicator that has to be re-typed into a firewall by hand is an indicator that is not enforced.
The platform becomes the job
A self-hosted TIP that ships a dozen upgrades a year turns the analyst into an administrator.
First week
From install to a scheduled hunt in five working days.
01
Day 1: install
Compose on one host. Migrations run once. The default sources start pulling within the hour.
02
Day 2: a sensor
A Pi or a container wearing the persona that matches your estate: a FortiGate clone in front of a FortiGate, say.
03
Day 3: enforcement
The firewall pulls an EDL or RPZ with ETag polling; sightings come back on the same key.
04
Day 5: the first hunt
A saved query on what hit the sensor, scheduled nightly, notifying the on-call channel.
Built for a team of four
Analyst experience that respects the headcount.
Triage board first
Severity ≥ high, first-party sources, last 24 hours: the view that opens is the one that matters.
Saved queries as hunts
Any search runs on a schedule and notifies. The hunt keeps running when the analyst goes home.
Explainable ML
A triage model that learns from your team’s decisions and shows per-feature contributions, so a junior can read why.
Advanced AI Intelligence
Ask your intel
A grounded question box over your own data, with citations; with AI off it returns retrieval-only answers.
Advanced AI Intelligence
Playbooks for the toil
Tag, enrich, add-to-case, notify, ticket, with a dry run and a rate cap; consequential actions wait for approval.
Automated Playbooks
One console, ⌘K
Every page and entity reachable from a palette; filters live in the URL so a view is a link.
Ownership
Nothing goes to us. Nothing is rented.
On-prem, the platform does not call home: the licence is a signed file verified offline, and the sensors are Wahukeza’s own kits reporting only to your platform. AI is local, your own key, or off; retrieval is Postgres. The platform fetches public data such as NVD and vendor advisories, and every external fetch can be switched off. If we disappear, you still have a working platform and a sensor you own.
- Platformyour host / your cluster
- Databaseyour Postgres 16
- Sensorsyour Pi, container or appliance
- AIlocal, your own key, or off
- RetrievalPostgres full-text search
- Feeds outyour firewalls, your SIEM, your MISP
A pilot sensor takes an afternoon.
Install, point a sensor, pull a blocklist. In a week you know what is knocking and what got past the login wall.