Triagewall

The product is a self-hosted alert triage system that turns high-volume Suricata and Wazuh alerts into a source-aware investigation queue, using deterministic policy to resolve repeat noise and a local model to reason over the remainder. It sells to IT, operations and security teams in businesses that operate Suricata and/or Wazuh on hardware they control. It is positioned as a read-only triage layer that does not block traffic or replace sensors, processing all telemetry locally with no cloud model or telemetry.

Key features

• Deterministic policy for Suricata noise filtering
• Local Ollama model verdict with confidence and reasoning
• Source-aware investigation queue
• Source-specific evidence projection and isolation
• Bounded search by signature, IP and asset
• Tails Suricata eve.json and Wazuh alerts.json
• Durable checkpoints for stream ingestion
• Revisioned exact-IP asset snapshots
• Per-process canary check on model output
• Strict three-field response contract