Home/Managed Wazuh

Managed Wazuh

Wazuh, run for you. Every alert explained.

Suriq runs the open-source Wazuh engine for you, ranks what it finds into incidents, and explains each one in plain English. Fixes wait for your approval. Wazuh is the engine. Suriq is the team that runs it and the console that makes it readable.

The short answer

What is managed Wazuh as a service?

Managed Wazuh as a service means a provider runs the open-source Wazuh platform for you - provisioning the Wazuh manager and indexer, tuning rules and decoders, scaling storage, and patching - so your team gets Wazuh's detection without operating it. Suriq runs that core on a dedicated manager for your team and adds the layer around it, on one console.

With Suriq's managed Wazuh you get:

Wazuh detection provisioned, mapped to each host's services, and health-checked, on a dedicated manager for your team.
Repeat alerts grouped into ranked incidents with an audit trail, instead of a firehose.
An assistant explaining what fired, why, and what to check next, and drafting fixes for you to approve.
Which machines a known CVE hits, most severe first.
File integrity monitoring tagged to MITRE ATT&CK, with changed system files checked against what your distribution or panel actually shipped.
Uptime and external-surface monitoring, server snapshots on the clouds you run, and secrets in a vault you choose.

What managed actually means

You get Wazuh's detection. We carry the operating.

Self-hosting Wazuh means provisioning the manager and indexer, tuning rules and decoders, scaling storage, patching, and keeping it healthy around the clock. Suriq stands up and runs that core for you - provisioned, rule-mapped, and health-checked - so your team gets the detection without the second job.

What you get

Ranked incidents, not a firehose

Repeat alerts are deduplicated and bundled into one incident, tagged to MITRE ATT&CK, ranked by severity, and routed to the channels your team already uses. Every step is in the audit trail.

Plain English on what fired and why

The built-in assistant turns a technical detection into a plain-English story: what happened, why the rule fired, what to check next. When it drafts a fix, the fix waits for your approval.

A new CVE lands and you know which machines it hits

Package inventories are matched against known CVEs on a regular schedule, so exposure is ranked most severe first. No fleet-wide scan to run first.

Changed files, checked against the vendor

File integrity monitoring reports the change. Suriq goes one step further and checks system files against the packages your distribution or control panel actually shipped, so you chase the one file that matters.

The outside is watched too

Certificate expiry, DNS and zone changes, WHOIS changes, BGP routes with RPKI validation, and uptime checks, from multiple regions. The exposure Wazuh does not see.

Backups and secrets, handled

Snapshots on the clouds you already run, with a clean restore point ready. Credentials the platform needs live in a vault you choose, with least-privilege access.

Side-by-side

Self-hosted Wazuh vs. Managed by Suriq

Dimension	Self-hosted Wazuh	Suriq
Setup and upkeep	You install, tune, scale, and patch	We provision, tune, and keep it healthy
Who operates it	Your team, on call	Suriq, on a dedicated manager for your team
Alert triage	Deep detections, decode them yourself	Ranked incidents, explained in plain English
Changes to your servers	You, by hand	Proposed by the assistant, applied after you approve
External surface	Not Wazuh's job	DNS, BGP/RPKI, certificates, uptime watched
Recovery	Manual	Snapshots ready, DNS failover that reverts on recovery
Secrets	Wherever you left them	In a vault you choose, least privilege

Explore the capabilities

Capability

Know which machines a new CVE hits.

Regular package scanning against known CVEs, scored by CVSS and ranked worst-first, with a fix Guardian can explain.

Capability

Incident response, with context in hand.

Detections bundled into one correlated incident, tagged to MITRE, routed to on-call, and explained in plain English.

Use case

The SIEM that is finally worth running.

Managed, Wazuh-powered detection in the box - a Splunk and Sentinel alternative with no SPL or KQL to hand-write.

Reality check

What Suriq does not do

No human analyst desk. Detection and the assistant run around the clock and incidents reach your channels; your team makes the call.
No silent changes. Fixes are proposed and wait for approval. Automatic actions, such as DNS failover for a host that drops, run only where you set them up.
Not every operating system yet. Tell us what you run when you request access and we will say plainly whether it installs today.
No public pricing yet. Early access is open and pricing is being finalized; we scope it to your environment.

FAQ

Frequently asked questions

What is managed Wazuh?

Managed Wazuh means Suriq runs the open-source Wazuh detection platform for you - provisioning a dedicated Wazuh manager and indexer for your team, mapping detection rules to each host, and watching its health around the clock - so your team gets Wazuh's detection without operating it.

How is Suriq's managed Wazuh different from self-hosting Wazuh?

Self-hosting means you provision, tune, scale, and patch Wazuh and stay on call for it. Suriq runs that core for you and adds the layer around it: repeat alerts grouped into ranked incidents, an assistant explaining each one in plain English, external-surface and uptime monitoring, server snapshots, and a secrets vault, all in one console.

Does Suriq run the real open-source Wazuh?

Yes. The detection engine is Wazuh, the open-source security platform, on a dedicated manager that Suriq provisions and runs for your team. You keep Wazuh's detection and MITRE ATT&CK tagging; Suriq handles provisioning, rule mapping, and health monitoring.

Can I add my own detection rules?

Partly. You can write your own file integrity rules, and suppress or override Suriq's detection rules per host or across your team. Suriq maintains the managed detection rules and maps them to the services it finds on each host.

Who watches at 3am? Is there a human SOC?

Detection and the assistant's explanations run around the clock, and every incident reaches the channels your team already uses, so nothing waits for a night shift. Suriq does not staff a human analyst desk; your team decides and acts, with the incident already ranked and explained when they open it.

How fast can Suriq show my CVE exposure?

Without a scan you have to run. Package inventories are matched against known CVEs on a regular schedule, so the console shows which machines a CVE affects, most severe first, and keeps that view current.

Does Suriq change anything on my servers by itself?

Not unless you set it up to. Suriq detects, ranks, and explains what is wrong and proposes a fix that waits for someone on your team to approve it. Automatic actions, such as DNS failover for a monitored host that drops, run only where you configure them.

How is managed Wazuh priced?

Pricing is being finalized, so we are not publishing a billing model, plan structures, or numbers yet. Get on the early-access list and we will scope pricing to your environment - you will be first to see it when it is set.

See it on your own machines.

Agentless for uptime and cloud monitoring, a lightweight agent for detection, all on a Wazuh core we run for you. Request access and we will walk you through it on your fleet.

Get Access See the platform