Available now
A real alert queue.
Ingest Wazuh alerts across agents and rule levels. Search, filter by severity and time, and inspect the original detection without switching between disconnected views.
Read-only adapterAuthenticated workspace
INDEPENDENT SOC WORKSPACE
The alert is only
the beginning.
Connect your detections to a clearer investigation path. Keep the original evidence, understand the context, and make the next decision with something to stand on.
Wazuh-first. Read-only. Human judgment stays in the loop.
+ THE CORVUS INVESTIGATION LAYER 01—03
The investigation layer
Alerts retain their identity and context. The collector and Analyst build on the source, rather than replacing your SIEM.
DESIGNED AS A COMPANION.
NOT ANOTHER SIEM.
NOT ANOTHER SIEM.
WazuhNext.jsPostgreSQLAzure FoundryDocker
A WORKSPACE, NOT A WALL OF SIGNALS
Your sources intact.
Your workflow in one place.
Live detections, durable records, original evidence.
The operational essentials, connected.
Available now
Identity comes with it.
Keep the connection, native index, document ID, timestamps, and original source. Normalization adds usable context without replacing the underlying evidence.
Native referenceOriginal JSON
Available now
The browser is not
your database.
PostgreSQL preserves records independently of a browser session. Idempotent inserts and checkpointed polling let the worker catch up without pretending incomplete queries succeeded.
- Durable alert records
- Visible backfill and sync health
- No archive mirroring
Analyst core
Context beyond
the trigger.
The collector retrieves bounded surrounding activity and process ancestry. The Analyst separates observations, inferences, alternative explanations, and gaps in an advisory report.
Analyst engine implemented. Dashboard triage is the next rollout.
FOLLOW THE DATA
Follow the signal.
Inspect every layer.
Explore where an alert goes, what gets stored,
and where model processing begins—and ends.
A source-preserving path from Wazuh to your queue. This is running in the live workspace.
01
Wazuh
Wazuh owns detection and telemetry retention. Corvus reads alert indices across agents and rule levels without changing rules or endpoint configuration.
01
Backend boundaries
Wazuh-specific queries and field mappings stay inside the adapter. The collector and Analyst work with an evidence contract, not a forked SIEM.
02
Storage boundaries
Operational records live in PostgreSQL. High-volume telemetry stays in Wazuh and is retrieved only within a scoped collection.
03
Authority boundaries
Data retrieval, external analysis, report validation, and human review are separate steps. None grants the model permission to execute a response.
WHAT MAKES CORVUS DIFFERENT
Clearer context.
Accountable decisions.
A detection is a lead.
Rule names and severity are starting points, not proof of compromise. Keep the source close enough to challenge the interpretation.
Unknown stays unknown.
Failed collection is not “nothing happened.” Gaps and partial windows stay visible instead of becoming confident model prose.
Findings need a trail.
Evidence binding and citation checks make reports easier to inspect. They do not replace review or prove that every claim follows from the logs.
Advice is not authority.
A recommendation is not an approved action. Corvus does not silently isolate hosts or turn a model label into incident resolution.
THE NEXT LAYER: ANALYST IN YOUR QUEUE
One Analyst.
Two deliberate ways to work.
The core investigation path stays the same.
You decide how an alert enters it.
Analyst core available · dashboard next
YOU CHOOSE THE STARTING POINT
Investigate deliberately.
Choose an alert, review the evidence-processing boundary, and request an investigation. The Analyst gathers scoped context and returns a report for review.
- 01Select a real alert
- 02Approve selected evidence processing
- 03Collect context and analyze
- 04Review findings and uncertainty
These controls explain the workflow; they do not change your connection settings or send evidence anywhere.
BUILT ON UNDERSTANDABLE PARTS
A focused stack.
Clear responsibilities.
Focused by design.
Every component has a clear responsibility.
THE INTERFACE
Next.js
React and TypeScript for an authenticated, responsive workspace. Your browser never receives backend or model credentials.
THE SERVICE
Python · FastAPI
A small API and a separate ingestion worker. Backend adapters, evidence collection, reporting, and model transport remain separate.
THE OPERATIONAL RECORD
PostgreSQL
Transactional checkpoints, indexed alert fields, original JSONB payloads, sessions, and audit events. A foundation for later operational analytics.
THE SECURITY BACKEND
Wazuh · OpenSearch
Keep your existing detections and telemetry pipeline. Read alerts and retrieve supporting context through documented indexer APIs.
THE ANALYST PROVIDER
Azure Foundry
The configured DeepSeek-V4-Flash deployment powers the advisory Analyst core. No automatic model substitution or hidden tool execution.
THE DEPLOYMENT
Docker · Caddy
Separate web, API, worker, and database containers. HTTPS at the edge, private service routing, and server-side secrets.
BEFORE YOU CONNECT
A few straight answers.
What runs today, what is next,
and what Corvus intentionally does not do.
Does Corvus replace Wazuh?
No. Wazuh remains responsible for detection and telemetry. Corvus is an independent companion that preserves incoming alerts and adds an evidence-led investigation workflow. You do not need to fork Wazuh or couple its lifecycle to Corvus.
What can I use in the workspace today?
Authenticated Wazuh connection setup, durable alert ingestion, severity and time filters, search, pagination, sync health, and original-source inspection. The Analyst core already exists separately; manual dashboard triage is the next integration. Automatic mode is planned, not currently enabled.
Does every alert get sent to a model?
No. The current ingestion worker makes no model calls. Analyst processing requires an explicit external-processing decision. Planned automatic mode will require separate connection-level consent and request limits; turning on ingestion will not opt you in.
Can the Analyst contain or remediate an endpoint?
No. It is read-only and has no response executor. Recommendations remain advisory. A model disposition, completed report, or passed citation check is not authorization for an endpoint action.
Why PostgreSQL instead of another analytics database?
The application needs transactions, deduplication, authentication, job state, and indexed queries first. PostgreSQL supports that operational workload and initial SQL analytics. High-volume raw telemetry stays in Wazuh rather than being copied into another event lake.
What happens when telemetry is missing?
Collection failures, truncation, incomplete time windows, and missing ancestry are preserved as explicit gaps. The Analyst must distinguish unknown activity from evidence of absence. Schema and citation checks improve inspectability but do not prove narrative accuracy.
Your alerts.
A clearer next step.
Bring the source into focus. Leave the assumptions behind.