Wildbox

Wildbox is a self-hosted security operations platform for teams that want threat research, cloud checks, vulnerability tracking, and response workflows in one place. It is a strong fit for security and platform teams willing to run their own tooling; its breadth comes with real deployment and production-security responsibilities.

Overview

Released under the MIT license, Wildbox combines security monitoring, analysis, and automated response behind a dashboard and REST APIs. Its Docker Compose quick start makes a local deployment concrete, with the dashboard at localhost:3000. That route suits teams seeking control over where the platform runs, but it is not a managed service: operators must handle deployment and secure the installation themselves.

For production, the project advises replacing default secrets and using HTTPS/TLS for external traffic. API endpoints require Bearer-token authentication, with API-key authentication also used for some services. Internal microservices communicate through APIs secured with X-Gateway-Secret headers, so teams should account for credential handling as part of deployment.

Key features

Threat intelligence and cloud posture

Wildbox aggregates threat data from more than 50 sources for IOC lookup and enrichment. This gives analysts a broad starting point for investigating indicators within the same platform they use for response. Cloud checks cover AWS, Azure, and GCP, scanning for misconfigurations and tracking security posture; that makes the feature set relevant to teams managing more than one cloud environment.

Vulnerability tracking and response

The platform scans, prioritizes, and tracks CVEs across assets through remediation. Pairing that lifecycle with YAML-based playbooks gives teams a way to turn repeatable incident-response steps into automated workflows. The playbooks are useful where response processes can be expressed and maintained as YAML, but teams should choose another approach if they need a hosted service to operate those workflows for them.

Analysis, access, and integrations

Large language models can support threat analysis and report generation, but Wildbox requires users to bring their own provider. That offers a path to LLM-assisted work without bundling a provider, while leaving provider selection and setup to the team. Users, teams, and role-based access control sit behind an authenticated API gateway. Configurable integrations cover ticketing, SIEM, notifications, and vulnerability tools; documented exports include JSON, CSV, SIEM feeds, and custom webhooks.

Pricing

Wildbox is free and open source under the MIT license, with no paid plan or free trial described. The free offering is the platform itself, rather than a hosted tier: users self-host it and take responsibility for deployment and security configuration. That makes it attractive to teams able to operate the software, but less suitable for buyers who need a vendor-managed deployment or bundled LLM provider.

Platforms

Wildbox is available for self-hosted deployment and lists API, Linux, macOS, web, and Windows platforms. The Docker Compose quick start and localhost dashboard provide a clear route to a local setup; the platform's self-hosted model means the team remains responsible for operating that environment.

Who it's for

Wildbox is aimed at organizations, security teams, DevOps and platform teams, and researchers. It is most compelling for groups that want threat intelligence, cloud posture checks, CVE workflows, and automated response together, and have the capacity to manage a self-hosted security tool. Teams seeking an externally operated service, or unwilling to manage secrets and TLS, should look elsewhere.

Pros and cons

• Broad security workflow coverage: threat data from more than 50 sources, cloud checks across AWS, Azure, and GCP, CVE tracking, and YAML playbooks cover connected investigation and response needs.
• Open-source self-hosting: the MIT license and free pricing suit teams that want to run the platform on infrastructure they control.
• Useful integration surfaces: REST APIs, configurable external integrations, and several export formats support connection to existing security workflows.
• Operational responsibility: self-hosting means teams must deploy and secure the platform, including replacing default secrets and enabling HTTPS/TLS for external traffic.
• Bring-your-own LLM provider: AI analysis and report generation depend on a provider the user supplies, adding setup outside Wildbox.

Alternatives

For another free, self-hosted SOAR option, OpenSOAR has no feature gates or per-action billing. Choose Tines if a hosted-style workflow offering with a free edition capped at three live workflows better fits your needs; its Business Edition starts at 30 flows, one licensed team, 100 users, and 1.5M [the supplied plan text is truncated]. Tracecat is another self-hosted open-source option, with unlimited workflows, cases, and agents and self-managed monthly executions.

For a broader monitoring service, Sumo Logic offers a free tier with 20 daily credits, seven-day log retention, and up to three users. Palo Alto Networks Cortex Cloud API Security is a paid alternative. Cyware Security Orchestration and Automation uses custom quotes based on deployment model, analyst seats, feeds, automation volume, sandbox capacity, digital risk protection, and selected add-ons. Defensys SOAR Platform and NetWitness Platform are also paid options.

Wildbox belongs on the shortlist for teams that want a free, MIT-licensed platform spanning threat intelligence, cloud posture, vulnerability management, and response automation. Its main reason to choose is that breadth under self-hosted control; its main reason to look elsewhere is the operational work of deployment, production hardening, and supplying an LLM provider.

Verdict

Choose Wildbox if your security, DevOps, or platform team can operate its own tools and wants investigation and response workflows together without a software fee. Look elsewhere if you need managed operations or a bundled AI provider: Wildbox's value depends on taking ownership of both the platform and its production configuration.