Asset view
Monitored systems are brought in from Wazuh as assets.
PrimoSOCSecurity operations
Security operations, organised around evidence.
PrimoSOC is a security operations portal built around Wazuh. It brings monitored systems into an asset view, groups detections into cases with their evidence attached, and puts every response decision through an explicit policy.
For teams that want a clear view of day-to-day security work
Growing businesses that run, or plan to run, Wazuh for detection and want an organised way to review what it finds, and teams that want response decisions to follow agreed rules.
The problem
Detection tools can produce alerts faster than a small team can read them. Without grouping, every alert looks urgent, the context is spread across consoles, and nobody can say later why a response was or wasn't taken.
Capabilities
Cases with evidence
Related detections are grouped into cases by deterministic rules, with the underlying findings linked to each case.
Policy gateway
Response actions are authorised by explicit rules rather than model confidence, with defined response modes that include a shadow mode where decisions are recorded without being carried out.
Audit trail
Every policy decision is written to an audit log.
Health at a glance
An overview of backend health and connected systems.
How it works
- 01
Connect
PrimoSOC reads from Wazuh's manager API and indexer on the server side, so backend credentials never reach the browser.
- 02
Sync
Monitored systems become assets and new findings are collected.
- 03
Group
Findings are grouped into episodes and cases.
- 04
Decide
Proposed responses pass through the policy gateway in the mode you have agreed.
- 05
Record
Decisions and their reasons are written to the audit log.
Use cases
A calmer queue
Review cases instead of individual alerts.
Evidence on hand
Open a case and see the findings behind it.
Safe introduction of response
Start in shadow mode, see what would have happened, then decide what to allow.
Accountability
Show later which decisions were made and why.
Questions
Does PrimoSOC replace Wazuh?
No. PrimoSOC works with Wazuh as its detection backend and adds the asset, case and policy layers on top.
Will PrimoSOC take actions on our systems automatically?
Response decisions go through the policy gateway in a mode you choose. In shadow mode, decisions are recorded but not carried out.
How do we start?
Send us an enquiry about your current monitoring and the workflows you need, and we will discuss how PrimoSOC fits.
Talk to us about PrimoSOC
Tell us a little about your organisation and what you need. We’ll reply by email.