Skip to content
SPECIFICTION
Get listed

Wildbox

wildbox.io

WebWindowsmacOSLinuxAPISelf-hosted
Visit wildbox.io
Spec score 6.9 #15 of 22 in SOAR Software

What it is

Wildbox is a self-hosted, open-source platform for security operations, including threat monitoring, analysis, and automated response. It is released under the MIT license and aggregates threat data from more than 50 sources for indicator-of-compromise lookup and enrichment. Its cloud security feature scans AWS, Azure, and GCP for misconfigurations and tracks cloud security posture. Vulnerability tools scan, prioritize, and track CVEs across assets through remediation. YAML-based playbooks support repeatable automated incident-response workflows. Wildbox also uses large language models for threat analysis and report generation, with users supplying their own provider. The platform includes users, teams, and role-based access through an authenticated API gateway. Its API documentation describes configurable integrations for ticketing, SIEM, notifications, and vulnerability tools, as well as JSON, CSV, SIEM-feed, and custom-webhook export options. The quick start uses Docker Compose and makes the dashboard available at localhost:3000. API endpoints require a Bearer token, with API-key authentication documented for some services. Production guidance advises replacing default secrets and using HTTPS/TLS for external traffic. Wildbox is available for Linux, macOS, and Windows, and can be accessed through web and API.

Spec sheet

Product
Wildbox is a self-hosted, open-source security operations platform for threat monitoring, analysis, and automated response.Read 7 Oct 2026 · wildbox.io
Intended users
The site names organizations, security teams, DevOps and platform teams, and researchers as intended users.Read 7 Oct 2026 · wildbox.io
Deployment
The site’s quick-start instructions deploy Wildbox with Docker Compose and make its dashboard available at localhost:3000.Read 7 Oct 2026 · wildbox.io
API
Wildbox documents REST APIs for its services and describes JSON, CSV, SIEM-feed, and custom-webhook data export options.Read 7 Oct 2026 · wildbox.io
Integrations
The homepage says Wildbox has 11 integrated services and can connect cloud accounts, endpoints, and applications; its API reference describes integration management for external systems.Read 7 Oct 2026 · wildbox.io
Support
The site directs users to GitHub Discussions for questions and GitHub Issues for bug reports.Read 7 Oct 2026 · wildbox.io
License
Wildbox is open source under the MIT license.Read 7 Oct 2026 · wildbox.io
Access control
The platform provides users, teams, and role-based access control behind an authenticated API gateway.Read 7 Oct 2026 · wildbox.io
AI analysis
Wildbox uses large language models for threat analysis and report generation, with users bringing their own provider.Read 4 Oct 2026 · wildbox.io
API authentication
The documentation says API endpoints require a Bearer token and also describes API-key authentication for some services.Read 4 Oct 2026 · wildbox.io
Automated response
YAML-based playbooks support repeatable, automated incident response workflows.Read 7 Oct 2026 · wildbox.io
Cloud security
Its cloud security feature scans AWS, Azure, and GCP for misconfigurations and tracks cloud security posture.Read 7 Oct 2026 · wildbox.io
Identity and access
The platform provides users, teams, and role-based access control behind an authenticated API gateway.Read 4 Oct 2026 · wildbox.io
Incident response
YAML-based playbooks support repeatable automated incident-response workflows.Read 4 Oct 2026 · wildbox.io
LLM analysis
Wildbox uses large language models for threat analysis and report generation, with the user bringing their own provider.Read 7 Oct 2026 · wildbox.io
Security guidance
The project security policy advises production users to replace default secrets and use HTTPS/TLS for external traffic.Read 4 Oct 2026 · github.com
Security operations
The docs describe bearer-token and API-key authentication, and say internal microservices communicate through APIs secured with X-Gateway-Secret headers.Read 7 Oct 2026 · wildbox.io
Threat intelligence
Wildbox aggregates threat data from 50+ sources for indicator-of-compromise lookups and enrichment.Read 7 Oct 2026 · wildbox.io
Vulnerability management
Wildbox scans, prioritizes, and tracks CVEs across assets through remediation.Read 7 Oct 2026 · wildbox.io

Strong points and limits

Strong points

  • Open source under the MIT license
  • Aggregates threat data from more than 50 sources
  • Scans AWS, Azure, and GCP for misconfigurations
  • YAML playbooks automate incident-response workflows
  • Supports JSON, CSV, SIEM-feed, and webhook exports

Limits

  • Self-hosted deployment is required
  • Users must supply their own LLM provider
  • Production guidance calls for replacing default secrets
  • External traffic should use HTTPS/TLS

Who it suits

Wildbox is aimed at organizations, security teams, DevOps and platform teams, and researchers seeking a self-hosted security operations platform. Users need to bring their own large-language-model provider for AI analysis and report generation.

Verdict

Wildbox brings threat intelligence, cloud checks, vulnerability tracking, and response automation into a self-hosted platform. Deployment and production security require attention to Docker Compose, secrets, and HTTPS/TLS.

Where Specifiction places it

Alternatives to WildboxAll alternatives →