- Home
- SOAR Software
- Wildbox
Wildbox
What it is
Wildbox is a self-hosted, open-source platform for security operations, threat monitoring, analysis and automated response. Released under the MIT license, it combines threat intelligence, cloud security checks, vulnerability management and incident-response workflows. It draws threat data from more than 50 sources for indicator-of-compromise lookup and enrichment. Its cloud feature checks AWS, Azure and GCP for misconfigurations, while its vulnerability tools scan, prioritize and track CVEs across assets through remediation. YAML-based playbooks support repeatable response workflows. Wildbox can use large language models for threat analysis and report generation, but users bring their own provider. It provides users, teams and role-based access behind an authenticated API gateway, with configurable integrations for ticketing, SIEM, notifications and vulnerability tools. The quick start uses Docker Compose and serves the dashboard at localhost:3000. API endpoints require a Bearer token, with API-key authentication described for some services. Production guidance advises replacing default secrets and using HTTPS/TLS for external traffic.
For and against
For
- Open source under the MIT license
- Threat data from more than 50 sources
- Tracks CVEs through remediation
- YAML-based automated response playbooks
Against
- Users must bring their own LLM provider
- Production guidance calls for replacing default secrets
- External traffic should use HTTPS/TLS
The verdict
Wildbox brings threat intelligence, cloud checks, vulnerability tracking and automated response into a self-hosted platform. Teams should account for deployment and production security guidance, as well as supplying their own provider for LLM analysis.
Who it suits
Wildbox is aimed at organizations, security teams, DevOps and platform teams, and researchers seeking a self-hosted security operations platform. It may suit teams that want to combine threat monitoring, cloud checks and response automation.
On the record
- Access control
- The platform provides users, teams, and role-based access control behind an authenticated API gateway.wildbox.io · read 7 Oct 2026
- AI analysis
- Wildbox uses large language models for threat analysis and report generation, with users bringing their own provider.wildbox.io · read 4 Oct 2026
- API
- Wildbox documents REST APIs for its services and describes JSON, CSV, SIEM-feed, and custom-webhook data export options.wildbox.io · read 7 Oct 2026
- API authentication
- The documentation says API endpoints require a Bearer token and also describes API-key authentication for some services.wildbox.io · read 4 Oct 2026
- Automated response
- YAML-based playbooks support repeatable, automated incident response workflows.wildbox.io · read 7 Oct 2026
- Cloud security
- Its cloud security feature scans AWS, Azure, and GCP for misconfigurations and tracks cloud security posture.wildbox.io · read 7 Oct 2026
- Deployment
- The site’s quick-start instructions deploy Wildbox with Docker Compose and make its dashboard available at localhost:3000.wildbox.io · read 7 Oct 2026
- Identity and access
- The platform provides users, teams, and role-based access control behind an authenticated API gateway.wildbox.io · read 4 Oct 2026
- Incident response
- YAML-based playbooks support repeatable automated incident-response workflows.wildbox.io · read 4 Oct 2026
- Integrations
- The homepage says Wildbox has 11 integrated services and can connect cloud accounts, endpoints, and applications; its API reference describes integration management for external systems.wildbox.io · read 7 Oct 2026
- Intended users
- The site names organizations, security teams, DevOps and platform teams, and researchers as intended users.wildbox.io · read 7 Oct 2026
- License
- Wildbox is open source under the MIT license.wildbox.io · read 7 Oct 2026
- LLM analysis
- Wildbox uses large language models for threat analysis and report generation, with the user bringing their own provider.wildbox.io · read 7 Oct 2026
- Product
- Wildbox is a self-hosted, open-source security operations platform for threat monitoring, analysis, and automated response.wildbox.io · read 7 Oct 2026
- Security guidance
- The project security policy advises production users to replace default secrets and use HTTPS/TLS for external traffic.github.com · read 4 Oct 2026
- Security operations
- The docs describe bearer-token and API-key authentication, and say internal microservices communicate through APIs secured with X-Gateway-Secret headers.wildbox.io · read 7 Oct 2026
- Support
- The site directs users to GitHub Discussions for questions and GitHub Issues for bug reports.wildbox.io · read 7 Oct 2026
- Threat intelligence
- Wildbox aggregates threat data from 50+ sources for indicator-of-compromise lookups and enrichment.wildbox.io · read 7 Oct 2026
