SocTalkAI-first SOC platform for MSPs and MSSPs

Run a dedicated Wazuh stack per customer on your own Kubernetes, behind one control plane.

Multi-tenant

A single control plane runs per-customer SOC stacks in isolated Kubernetes namespaces, with Postgres RLS as the data-isolation backstop.

Wazuh data plane

Each customer gets their own Wazuh manager and indexer. Agents enroll over hostname-routed ingress. Fully open source.

AI triage, human gate

LangGraph workers do the triage and propose actions; analysts approve escalations. BYO LLM per tenant.

Three steps in

1. Evaluate — demo VM. Single image, browser wizard, 5 minutes to a running install with a demo tenant. Available as QCOW2, VMDK, VHDX, VHD, and raw on the downloads page. Best way to see the AI SOC analyst answering real Wazuh queries end-to-end on a laptop.

2. Pilot — MSSP pilot rollout. The recommended next step: two on-premise environments (MSSP control plane + 1-3 tenants), connected by a firewall-friendly mesh VPN, running the full multi-tenant flow with real customer data. End state: an AI SOC analyst answering questions across your first pilot customers, and a stakeholder-ready screenshot.

3. Production — install guide. K3s + Cilium + cert-manager + Helm. Take an hour, end with a hardened multi-tenant install ready for your customer base.

What's here

Get Started — install paths (demo VM + production), MSSP UI tour.
Operate — daily ops, tenant lifecycle, upgrades, troubleshooting.
Integrate — LLM providers, TheHive, Cortex, Slack.
Reference — architecture, security model, RLS, chart contract, REST API.
Contribute — dev environment, PR expectations, release process.

Source: github.com/soctalk/soctalk. Apache 2.0.