# For SOC & CTI teams

> Self-hosted threat intelligence for SOC and CTI teams: your own sensors, 40+ sources in one scored graph, and enforcement in your firewalls' formats.

Source: https://wahukeza.com/solutions/soc

Solutions · SOC & CTI teams

## Your sensors. Your graph. Your ground.

For a team that wants intelligence about its own attack surface rather than a feed about everyone’s: device-faithful sensors forward of your network, 40+ sources correlated into one scored graph, and enforcement in the formats your stack already speaks, all on hardware you control.

[Start a pilot sensor](https://wahukeza.com/contact?intent=pilot)

[How the platform fits together](https://wahukeza.com/platform)

What a small team runs into

## Four reasons the free-feeds-in-a-SIEM approach stalls.

-   ### Feeds barely overlap
    
    Only a small fraction of indicators appear on a second list. A team wiring three feeds into a SIEM is paying for redundancy and still missing what is aimed at them specifically.
    
-   ### Nothing is aimed at you
    
    Public intelligence describes the world. It does not tell you what is knocking on your perimeter tonight, from which ASN, with which tooling.
    
-   ### Enforcement is a copy-paste job
    
    An indicator that has to be re-typed into a firewall by hand is an indicator that is not enforced.
    
-   ### The platform becomes the job
    
    A self-hosted TIP that ships a dozen upgrades a year turns the analyst into an administrator.
    

First week

## From install to a scheduled hunt in five working days.

1.  01
    
    ### Day 1: install
    
    Compose on one host. Migrations run once. The default sources start pulling within the hour.
    
2.  02
    
    ### Day 2: a sensor
    
    A Pi or a container wearing the persona that matches your estate: a FortiGate clone in front of a FortiGate, say.
    
3.  03
    
    ### Day 3: enforcement
    
    The firewall pulls an EDL or RPZ with ETag polling; sightings come back on the same key.
    
4.  04
    
    ### Day 5: the first hunt
    
    A saved query on what hit the sensor, scheduled nightly, notifying the on-call channel.
    

Built for a team of four

## Analyst experience that respects the headcount.

-   ### Triage board first
    
    Severity ≥ high, first-party sources, last 24 hours: the view that opens is the one that matters.
    
-   ### Saved queries as hunts
    
    Any search runs on a schedule and notifies. The hunt keeps running when the analyst goes home.
    
-   ### Explainable ML
    
    A triage model that learns from your team’s decisions and shows per-feature contributions, so a junior can read why.
    
    Advanced AI Intelligence
    
-   ### Ask your intel
    
    A grounded question box over your own data, with citations; with AI off it returns retrieval-only answers.
    
    Advanced AI Intelligence
    
-   ### Playbooks for the toil
    
    Tag, enrich, add-to-case, notify, ticket, with a dry run and a rate cap; consequential actions wait for approval.
    
    Automated Playbooks
    
-   ### One console, ⌘K
    
    Every page and entity reachable from a palette; filters live in the URL so a view is a link.
    

Ownership

## Nothing goes to us. Nothing is rented.

On-prem, the platform does not call home: the licence is a signed file verified offline, and the sensors are Wahukeza’s own kits reporting only to your platform. AI is local, your own key, or off; retrieval is Postgres. The platform fetches public data such as NVD and vendor advisories, and every external fetch can be switched off. If we disappear, you still have a working platform and a sensor you own.

[Deploy, identity & trust](https://wahukeza.com/platform/deploy)

-   Platformyour host / your cluster
-   Databaseyour Postgres 16
-   Sensorsyour Pi, container or appliance
-   AIlocal, your own key, or off
-   RetrievalPostgres full-text search
-   Feeds outyour firewalls, your SIEM, your MISP

## A pilot sensor takes an afternoon.

Install, point a sensor, pull a blocklist. In a week you know what is knocking and what got past the login wall.

[Book a demo](https://wahukeza.com/contact?intent=demo)

[See packages](https://wahukeza.com/pricing)