Integration · SIEMs
Wazuh
Reads every Wazuh alert into cases, and blocks addresses or isolates Linux machines through Wazuh’s own responses.
What Kandaro does with it
Kandaro SOC and Wazuh.
Where your alerts already land. Kandaro reads them, opens cases and investigates.
- Alerts in
Reads its alerts and groups them into cases with fixed rules.
- Research
Searches it for related activity while it investigates a case. This uses Kandaro Connect.
- Respond
Proposes these actions, and can run them through it once an admin approves:
- Block an address
- Isolate a machine
- Stop a process
How it connects
Pick the way that fits.
- Quick push
Your tool sends each alert to a private Kandaro address.
- Kandaro Connect
A small container on your network that only connects out. Adds research and response.
What Kandaro needs
What you set up once.
- Quick push: one integration block in your manager’s settings.
- Kandaro Connect: a read-only indexer account, plus Wazuh’s response API for actions.
Good to know
- A Wazuh block lifts itself after 24 hours and can’t be ended earlier.
- Isolating a machine and stopping a process need Kandaro’s response pack on Linux agents.
When Kandaro acts
A person says yes first.
The AI never closes a case and never acts on its own: every action waits for a person to approve it.
A person approves every action
Only an admin can approve, with a fresh second factor bound to that one action. Never from a chat message or an email link. A second approver can be required.
Proposals, not surprises
By default Kandaro shows the steps and you run them in your own tool. Letting Kandaro run them itself is a switch you turn on, after signing the SOC terms.
Everything can be reversed
Every block, disable and isolation can be reversed, most with one click. Blocks also end by themselves after a set time; a Wazuh block always runs its full 24 hours.
Limits and a pause button
Kandaro caps how many actions can run per hour, never acts on addresses in your allow list, and one switch pauses every action at once.
SIEMs
More tools like this.
Splunk
Reads notable events or a saved search into cases, and can send Kandaro’s findings back to Splunk.
- Alerts in
- Research
- Alerts out
- Cloud API
- Quick push
- Kandaro Connect
- Vendor API
Elastic Security
Reads Elastic Security alerts into cases, and can write Kandaro’s findings to a data stream.
- Alerts in
- Research
- Alerts out
- Cloud API
- Quick push
- Kandaro Connect
- Vendor API
Microsoft Sentinel
Reads Sentinel incidents and alerts into cases, and can write Kandaro’s findings to a Sentinel workspace.
- Alerts in
- Alerts out
- Cloud API
- Vendor API
Connect Wazuh to Kandaro SOC.
Request early access to Kandaro SOC, or start a 14-day trial of Kandaro Deception today.
Deception trial: card required · cancel before day 14 and pay nothing