Paste a Wazuh alert. Get the first five minutes of triage done.
Extracts every indicator, enriches the public ones, maps the rule to MITRE ATT&CK and the ASD Essential Eight, scores a suggested verdict with its reasoning shown, and writes the ticket. Suggestions only — the analyst owns the verdict.
Alert JSON
Alert
Frameworks
Indicators
| Type | Value | Context | Enrichment |
|---|
Why this verdict
Ticket
How it works
1 · Parse & extract
Accepts the JSON from Wazuh Discover, a line of alerts.json, or an OpenSearch document. Walks every field for IPs, hashes, URLs, domains, users, hosts, processes and command lines. Private ranges, the agent's own IP and file-state hashes are labelled, not enriched.
2 · Map
Rule ID → MITRE technique from the Wazuh ruleset (4,400 rules indexed offline), then technique → Essential Eight control using the mapping from my E8 Detection Lab, plus behavioural hints (an Office parent process implies E8-03 even when the rule only tags T1059).
3 · Score & write
Rules-based scoring an L1 would recognise: level, LOLBAS, Office parents, encoded PowerShell, brute-force-then-success, scanner accounts, destructive commands, VirusTotal hits. Every point is listed. Thresholds: ≥65 true positive, 30–64 escalate, below that false positive. The ticket is markdown you can paste into any tool.
Limits — read before trusting it
- Verdicts are suggestions. The scoring is heuristic and tuned on a 20-alert test suite (
tests/run.js, all passing). It will be wrong on things it hasn't seen. The reasoning is shown so you can disagree with a specific line, not the whole answer. - Enrichment depends on free APIs. VirusTotal (4 req/min) and AbuseIPDB (1,000/day) via a rate-limited proxy; results are cached for 24 h. When they're unavailable the ticket still generates with the indicator marked "unavailable".
- Nothing you paste is stored. Analysis runs in your browser. Only the individual public indicators you choose to enrich are sent to the proxy, which forwards them to the reputation services. Don't paste client data you're not allowed to share with those services.
- Wazuh 4.x alert shape. Custom decoders with unusual field names will still get the generic extraction, but not the field-specific reasoning.