We started with Wazuh. Here is the floor we built above it.
Why a free, open detection agent was the right place to start, what a detection agent was never meant to do, and how a source-agnostic decision layer turns Wazuh — or whatever stack you already run — into triaged cases with an owner, an escalation path and an explained verdict, without an ingest meter.
Integration scope: Seculogik uses a source-agnostic architecture to ingest security alerts and events through its own data map. Wazuh and OpenSearch are the first integrations. Other named sources describe planned connector targets; their availability must be confirmed for each evaluation.
If you run a lean internal SOC or a small MSSP in Europe, there is a fair chance Wazuh is already on the hosts you protect, and for good reason: the rules are open, the alerts are honest, the indexer is yours, and ingest costs nothing. That is where Seculogik started, and it is where the free edition still lives. It is also, to be clear from the first paragraph, not the only way in. Seculogik is the decision layer above whatever detection stack you already run. Wazuh is simply the one we grew up on.
The beachhead, not the foundation
Seculogik's free edition is Wazuh-only by design, and it holds exactly what the pricing page says it holds: alerts, cases, the analyst screens and notifications; the decision queue and SLA clocks; the 72 MITRE-mapped detection packs, switched on in a click, so a fresh estate has real detection coverage on day one rather than a blank rule set; single sign-on, MFA and role-based access; and a tamper-evident audit trail. It is fed by your Wazuh manager and indexer and nothing else. It is not a trial. Run it for as long as it fits.
Those packs matter more than the number suggests: writing that many rules yourself is detection engineering a three-person team rarely has time for, so the work sits on the backlog and the estate stays uncovered.
What it does not hold is worth knowing now rather than at quote time. In the free edition one alert makes one case: the Correlation Engine, the vendor connectors that make the platform source-agnostic and the Vulnerability Operations Centre all start at the Client edition, and SIROC, our AI analyst, is the Advanced AI module.
That is modularity, not a catch — you switch on what your estate asks for and pay for that. Most teams reach that day for a reason they can name: a second source to correlate with the first, a burst of repeats that should have been one case, a report a risk committee can read.
That start set two rules we still work to: no meter on your own logs, and the value has to come from the decisions, not the ingest. Wazuh gave us an honest, high-volume, zero-cost alert stream, and it pointed us at the teams least willing to pay a per-gigabyte meter to read their own logs. So we had to be good at the hard part — triaging that stream down to a small number of decisions a human can act on — rather than good at billing for it.
Wazuh alerts also arrive clean, already carrying the context that lets us rank them and put them in front of the right analyst, so we proved the model early instead of arguing about parsing; every other source reaches that state through its own connector or one mapping in the universal data map.
Wazuh is where we started. It was never meant to be where the decisions get made.
What a detection agent was never meant to do
A rule fires on one event. A campaign is many events — across an EDR, an identity provider and a firewall — over days. A detection agent has alerts but no cases: no lifecycle, no assignee, no SLA, no record of why anyone decided anything.
Nothing for a tier 1 to qualify and escalate, nothing for a tier 2 to pick up, and nothing that survives a shift handover. It has one flat alert stream rather than cases with an owner, a clock and a history — and for a managed provider serving several customers, no wall between one customer's work and the next.
When a single rule fires hundreds of times in a few minutes, it produces hundreds of rows and not one incident. That is where alert fatigue starts: nothing folds those rows together, so an analyst reads and dismisses the same event a hundred times. Its response is a script, where a SOC needs a playbook that stops and waits for a person before it isolates a host. And a dashboard is not a report a risk committee can read.
None of that is a criticism of Wazuh. It is the shape of a detection layer, whichever one you run, and it is the reason a decision layer above it has to exist. That is what a Seculogik is: not a SIEM, not an EDR, not a replacement for your sensors or your log store, but the place where their output becomes a decision.
The floor above — and it is source-agnostic
Here is what your analysts get that a detection layer cannot give them. A flood of alerts becomes a short queue of cases worth a human's attention, ordered by business impact rather than by which rule shouted loudest. Hundreds of low-severity repeats are deduplicated into one appropriately rated case, not hundreds of rows. Activity already judged a false positive stops coming back as a question. And nothing is lost if a component restarts mid-burst.
At the centre of it is the Correlation Engine, our crown jewel and the reason the Client edition exists: nine independent checks look at every alert from different angles — the entities involved, how far the attack has progressed, whether several sources agree, risk that builds slowly, known attack patterns, attacker clustering — and must agree on one verdict.
Every case keeps a readable decision trace: which signals mattered, how the verdict was reached, and what would have changed it. Recognised attack patterns (phishing to account takeover, exploit to foothold, execution to ransomware) mean a case reads as a story, and its kill-chain position advances with the evidence, so the queue ranks what is genuinely furthest along.
Around it sits Seculogik itself, in every paid edition: a queue that says what to open next, SLA clocks, and capacity-based assignment, so the next case lands with an analyst who has room for it. The Vulnerability Operations Centre — included with the Client edition, not sold separately — corroborates findings across scanners and runs a remediation lifecycle with due dates and a risk-acceptance register that expires.
Then the modules you choose to switch on.
- SIROC, the AI analyst — Advanced AI — argues both ways before it answers, then returns a verdict, a confidence score and its reasoning; that reasoning is checked against the case's own alerts, and an unsupported verdict is downgraded in front of the analyst.
- Response playbooks — Automations — stop at an approval gate before anything destructive, such as isolating a host, and no playbook can lower that bar.
- Reporting — SOC Reporting — produces scorecards for NIST CSF, ISO 27001, GDPR, DORA and NIS2 and evidence packs that state their own methodology and coverage: every number carries its evidence, and a metric that cannot be computed says so.
And if you are a managed provider serving several customers, the MSSP edition adds a hard wall between them and white-label reporting on top of all of it.
None of that is Wazuh-specific. From the Client edition up, the floor sits above whatever you already run: open-source SIEM and data stacks such as Wazuh, OpenSearch, Elastic / ELK and ClickHouse; market platforms such as Splunk, Microsoft Sentinel, CrowdStrike, Microsoft Defender, SentinelOne, Cortex XDR, Fortinet, Okta and Entra ID — 23 market-platform connectors in all — plus push webhooks and passive tailing of the SIEM you have.
If a source is not on the list, we build the connector — or you push events through the generic webhook and map them once in the universal data map. So the Wazuh estate you started with can absorb Sentinel, CrowdStrike and Okta without a second platform, and if you already run Splunk, Elastic or ClickHouse, the floor is not a second SIEM and does not replace your log store.
It is the layer that makes those sources agree: one verdict per campaign instead of one alert per tool, and one report a regulator can read — across all of them at once, with no second ingest bill.
No ingest tax, still
The thing we were most careful not to break is the economics. Gartner puts it plainly: SIEM buyers have grown increasingly frustrated by SIEM cost bloat. Most SIEM and XDR vendors charge per gigabyte, per event or per asset for the privilege of putting your own logs in, so the bill moves with your estate rather than with the work you get out of it.
The pricing page sets out our model instead. Seculogik does not meter your logs. Your log store stays yours — the Wazuh indexer, OpenSearch, Elastic, ClickHouse, whichever you run — and the platform sits above it on one self-hosted box, VPS or on-prem, no GPU required, installed in minutes. That is what settles the vendor lock-in question here: on the day you replace us, your logs, your rules and your indexer are where they always were, because they never moved.
The licence is quoted per deployment and per year, across three editions and six modules, and only two things move the price: the edition you deploy and the modules you switch on. There is no per-GB, no per-endpoint and no per-seat fee, so your line reads infrastructure plus operations. MSSP is a flat price per deployment — serve one customer or fifty for the same fee, because your growth is not our revenue event.
We will say the honest part too. Infrastructure plus operations still costs real money at scale; the win is the absence of a meter, not free. And where a Microsoft estate already bundles ingest, price is not the argument — and it is not the one we make.
What you cannot buy bundled is a decision layer you host yourself, hard separation between the customers you serve if you serve several, and an AI analyst whose every cloud-bound call you can audit. Sovereignty, for us, is a switch you own rather than a slogan: AI runs on your box on a local open-licence model by default, you bring your own cloud key per task if you choose, and every cloud-bound call is recorded in a tamper-proof ledger. That is the comparison we ask to be judged on.
Where to start
That leaves one question, and it is the one every reader ends on: which edition, and which modules. See the three editions — Free on your Wazuh, at no cost, for as long as you like; Client the day a second source or a risk committee makes the Correlation Engine worth turning on; MSSP when you are a provider separating the customers you serve.
If you run Wazuh today, start free: point it at your manager and watch the decision queue fill the same day, with no licence, no meter and nothing sent anywhere. Correlation, the connectors, the Vulnerability Operations Centre and SIROC arrive the day your estate asks for them, and not before. Either way you keep the stack you have — we built the floor above it.
When you want to see it on your own data, bring a week of alerts to a demo, Wazuh, Splunk, Sentinel, Elastic, ClickHouse or a mix, and we will replay them in a thirty-minute session and show you what the Correlation Engine makes of them.