Security monitoring · plugin
Security your agents can act on
Wazuh SIEM, joined to your Quox command centre, so alerts, vulnerabilities and compliance sit next to the infrastructure they belong to, where an agent can reason over them and a human can act.
In plain words
What it is, where it lives, when to reach for it
- What is it
- Wazuh SIEM joined to your Quox command centre, so security alerts, vulnerabilities and compliance sit next to the infrastructure they describe.
- Where do I use it
- In the QuoxCORE dashboard alongside your fleet, and in chat where CommanderQ triages the feed in context.
- When would I use it
- When you run your own infrastructure and want security signals your agents can reason over, not a separate SIEM tab.
- How do I use it
- Connect a Wazuh manager you run, deploy agents to fleet hosts from the dashboard, and get the plugin from the store.
QuoxCORE is the free, self-hosted platform underneath this. What is QuoxCORE
A SIEM in one tab and your operations in another is two half-pictures.
Security signals only help when they sit next to the systems they describe. Wazuh on Quox puts alerts, vulnerabilities and compliance in the same command centre as your fleet, where they can be cross-referenced and acted on rather than just watched.
What changes
What joining the SIEM to the command centre gives you
These are the shipped capabilities of the Wazuh plugin, framed by what they change day to day.
One command centre, not two
Security data lives beside your infrastructure data. CommanderQ sees a host’s alerts, vulnerabilities and compliance in the same place it already sees the host, not in a separate SIEM tab.
Alerts read in context
When an alert fires, CommanderQ cross-references the same host’s vulnerability and file-integrity state and gives one informed recommendation, instead of leaving you a raw feed to interpret.
Coverage you can roll out
Deploy the Wazuh agent to a fleet host from the dashboard over the same governed SSH path as the rest of Quox. No separate access to arrange, no manual install per box.
A trail behind every action
Triage and deployment run through the governed path, so what was seen and what was done is recorded, not just noticed in the moment.
How the data joins
Your Wazuh data never touches the browser
Every Wazuh API call is proxied through the Quox collector, which holds the credentials and handles rate limiting. The Wazuh API is never exposed to the browser or the public internet, and the credentials never reach the frontend.
Agent deployment uses the same governed SSH path as QuoxBastion, so bringing a new host under monitoring needs no extra network access beyond what Quox already has.
- Browser talks only to the dashboard, never to Wazuh directly
- Wazuh credentials stay server-side on the collector
- Agent installs run over the existing Bastion SSH path
- Requests are proxied, rate-limited and attributable
- Dashboardyour browser
- Collectorholds credentials, proxies, rate-limits
- Wazuh manageryour server, never public-facing
What you bring
- Requires QuoxCORE and a Wazuh v4.x manager you run yourself. Wazuh is open source and is not included.
- The plugin is a one-off unlock, not a subscription. Pricing lives on the store page.
- It surfaces, triages and deploys Wazuh; it does not replace running Wazuh. Your manager stays the source of the data.
Get it
Add the security desk to your command centre
The plugin is a one-off unlock in the store. The setup docs cover connecting your manager and deploying agents.