selfhost.directory

The index of self-hostable projects — ranked, categorized and served with live updates.
Own your data and stop giving it to big tech.

GitHubWebsite
Wildbox logo

Self-host Wildbox

v0.12.2

Open-source security operations platform with SIEM and SOAR

BetaOpen SourceMIT
GitHubWebsite
Install
Updatedlast week
LanguagePython
Setup difficultyAdvanced
Stars
134
CPU
Docker Engine 23.0+ with Compose plugin 2.24.4+
RAM
8 GB minimum (16 GB recommended)
Storage
20 GB free disk (50 GB SSD recommended for production)
Ports
443 (HTTPS gateway (main entry point for all clients)), 80 (HTTP redirect to HTTPS (health check only)), 8080 (HTTP redirect to HTTPS (health check only)), 8081 (Internal gateway listener for identity cache purge (not published to host)), 8001 (Identity service (authentication, users, teams, API keys)), 8000 (Security tools API), 8002 (Data service (threat intelligence, IOCs)), 8004 (Sensor service (endpoint telemetry, osquery)), 8006 (Agents service (AI-assisted analysis)), 8013 (Guardian service (vulnerability and asset management))
Install with Docker Compose

What is Wildbox?

Should you self-host Wildbox?

Wildbox scores 44/100 on selfhost.directory (how scoring works) and ranks #56 of 78 in Security. It has 134 GitHub stars.

It shipped 10 stable releases in the past year. The latest, v0.12.2, came out on 6 October 2026.

Setup is advanced: plan for several services and some ongoing maintenance. It is MIT-licensed and written mostly in Python.

Its closest alternative on selfhost.directory is pentagi (83/100, 32 610 stars). It scores higher overall, so compare the two before you pick. See Wildbox vs pentagi side by side.

Features

  • API Gateway
  • API Key Scopes
  • Automated Response (SOAR)
  • Cloud Security Posture Management (CSPM)AWS only; GCP and Azure not supported
  • Endpoint Telemetry
  • Identity & Access Management
  • LLM-Assisted AnalysisOptional; requires Anthropic API key
  • Monitoring (Prometheus/Alertmanager)Optional profile; default config notifies nobody
  • Multi-tenancy with Teams
  • Scheduled BackupsOptional profile
  • Security Tools Platform
  • Threat Intelligence
  • Vulnerability management
  • Web Dashboard
  • Workflow Automation (n8n)Optional profile

Wildbox README

How to install Wildbox

Install Wildbox with Docker Compose

Environment variables
See .env.example for all configuration options. Key variables: ENVIRONMENT, JWT_SECRET_KEY, API_KEY_HASH_SECRET, GATEWAY_INTERNAL_SECRET, POSTGRES_PASSWORD, REDIS_PASSWORD, API_KEY, INITIAL_ADMIN_EMAIL, INITIAL_ADMIN_PASSWORD, GUARDIAN_SECRET_KEY, CSPM_SECRET_KEY, DATA_SECRET_KEY, SENSOR_API_KEY, ANTHROPIC_API_KEY, CSPM_CREDENTIAL_KEY, RATE_LIMIT_PER_HOUR, GATEWAY_RATE_LIMIT_PER_SECOND, REDIS_MAXMEMORY, REDIS_MEMORY_LIMIT, CORS_ORIGINS, DEBUG, LOG_LEVEL

git clone https://github.com/fabriziosalmi/wildbox.git cd wildbox

make generate-secrets # writes .env with random values for every secret (mode 0600)

edit INITIAL_ADMIN_EMAIL in .env: it is the login of the first administrator

make validate-secrets # refuses placeholder values

docker compose up -d --wait # builds and starts the stack; the first build takes several minutes

Primary installation method. All services built from source. Optional profiles: automations, monitoring, backup.

How to configure Wildbox

  • AGENT_TEAM_DATA_TOOLSTeam-data tools the AI analysis may use: threat_intel_query_tool, vulnerability_search_tool. Empty gives neither.

    Team-data tools the AI analysis may use: threat_intel_query_tool, vulnerability_search_tool. Empty gives neither.

    values: comma-separated tool names

  • ALERTMANAGER_CONFIG_FILE./monitoring/alertmanager.ymlAlertmanager configuration file to mount. Default notifies nobody. Point at custom config for email/webhook notifications.

    Alertmanager configuration file to mount. Default notifies nobody. Point at custom config for email/webhook notifications.

    values: file path

  • ALERTMANAGER_EXTERNAL_URLhttp://127.0.0.1:9093Address Alertmanager UI is reached at for notification links. Default http://127.0.0.1:9093.

    Address Alertmanager UI is reached at for notification links. Default http://127.0.0.1:9093.

    values: URL

  • ALERTMANAGER_SECRETS_DIR./monitoring/secretsDirectory of secret files for Alertmanager (SMTP passwords, webhook URLs). Files must be readable by UID 65534.

    Directory of secret files for Alertmanager (SMTP passwords, webhook URLs). Files must be readable by UID 65534.

    values: directory path

  • ANALYZE_RATE_LIMIT5/minuteAnalyses each user may submit. Limits notation (e.g., 5/minute). Default 5/minute.

    Analyses each user may submit. Limits notation (e.g., 5/minute). Default 5/minute.

    values: limits notation

  • ANALYZE_TEAM_RATE_LIMITOptional ceiling for whole team analyses. Empty means none.

    Optional ceiling for whole team analyses. Empty means none.

    values: limits notation

  • ANTHROPIC_API_KEYAnthropic API key for LLM threat analysis. Optional; agents service starts without it and analysis fails gracefully.

    Anthropic API key for LLM threat analysis. Optional; agents service starts without it and analysis fails gracefully.

    values: Anthropic API key

  • ANTHROPIC_MODELclaude-opus-4-8Anthropic model for AI analysis. Default claude-opus-4-8.

    Anthropic model for AI analysis. Default claude-opus-4-8.

    values: Anthropic model name

  • API_KEYRequired by the tools service at start-up. Not a request credential; the tools service accepts only requests forwarded by the gateway. Generate with: openssl rand -hex 32

    Required by the tools service at start-up. Not a request credential; the tools service accepts only requests forwarded by the gateway. Generate with: openssl rand -hex 32

    values: 32-char random string

  • API_KEY_HASH_SECRETKeys the HMAC of stored API-key digests, separate from JWT_SECRET_KEY so rotating JWT key leaves API keys valid. Required for existing deployments to seed from JWT_SECRET_KEY first.

    Keys the HMAC of stored API-key digests, separate from JWT_SECRET_KEY so rotating JWT key leaves API keys valid. Required for existing deployments to seed from JWT_SECRET_KEY first.

    values: 32-byte hex string

  • AUTOMATIONS_WILDBOX_API_KEYPersonal API key (read scope) for n8n workflows to call the API through the gateway.

    Personal API key (read scope) for n8n workflows to call the API through the gateway.

    values: API key string

  • BACKUP_INTERVAL_SECONDS86400Interval between backup runs in seconds. Default 86400 (daily).

    Interval between backup runs in seconds. Default 86400 (daily).

    values: integer

  • BACKUP_RETENTION30Number of days to keep backups. Default 30.

    Number of days to keep backups. Default 30.

    values: integer

  • CORS_ORIGINShttp://localhost:3000Origins whose pages may call the API from a browser. Default http://localhost:3000.

    Origins whose pages may call the API from a browser. Default http://localhost:3000.

    values: comma-separated origins

  • CREATE_INITIAL_ADMINtrueWhether to create the initial admin on startup. Defaults to true.

    Whether to create the initial admin on startup. Defaults to true.

    values: true, false

  • CSPM_CREDENTIAL_KEYEncrypts cloud credentials before CSPM writes them to Redis. Required: CSPM service refuses to start a scan without it.

    Encrypts cloud credentials before CSPM writes them to Redis. Required: CSPM service refuses to start a scan without it.

    values: random string

  • CSPM_REPORT_RETENTION_DAYS90Days CSPM keeps a scan in Redis (metadata, team index, report). 1-3650. Default 90.

    Days CSPM keeps a scan in Redis (metadata, team index, report). 1-3650. Default 90.

    values: 1-3650

  • CSPM_SCAN_TIMEOUT_SECONDS3600Time limit for one CSPM scan in seconds (120-86400). Default 3600.

    Time limit for one CSPM scan in seconds (120-86400). Default 3600.

    values: 120-86400

  • CSPM_SECRET_KEYSecret key for CSPM service (min 32 chars). Service refuses to start without it.

    Secret key for CSPM service (min 32 chars). Service refuses to start without it.

    values: min 32 characters

  • DATA_SECRET_KEYApplication secret for the data service. Config refuses to start without one unless ENVIRONMENT=development.

    Application secret for the data service. Config refuses to start without one unless ENVIRONMENT=development.

    values: random string

  • DEBUGfalseDebug mode for services. Default false.

    Debug mode for services. Default false.

    values: true, false

  • ENVIRONMENTproductionDeployment environment: production, staging, or development. Only development serves API schemas and may run without secret checks. Compose refuses to start without it.

    Deployment environment: production, staging, or development. Only development serves API schemas and may run without secret checks. Compose refuses to start without it.

    values: production, staging, development

  • EXECUTIVE_REPORT_EMAIL_FROMSender email for executive report.

    Sender email for executive report.

    values: email address

  • EXECUTIVE_REPORT_EMAIL_TORecipient email for executive report.

    Recipient email for executive report.

    values: email address

  • FLOWER_PASSWORDCelery Flower UI basic auth password. Required.

    Celery Flower UI basic auth password. Required.

    values: secure password

  • FLOWER_USERadminCelery Flower UI basic auth username. Default admin.

    Celery Flower UI basic auth username. Default admin.

    values: string

  • GATEWAY_AUTH_RATE_LIMIT_PER_SECOND5Rate limit for login, registration, and forgotten password routes. Default 5.

    Rate limit for login, registration, and forgotten password routes. Default 5.

    values: 1 to 100000

  • GATEWAY_INTERNAL_SECRETShared secret the gateway presents to identity and backend services for internal authentication. Generate with: openssl rand -hex 32

    Shared secret the gateway presents to identity and backend services for internal authentication. Generate with: openssl rand -hex 32

    values: 32-byte hex string

  • GATEWAY_RATE_LIMIT_PER_SECOND100Requests per second the gateway accepts from one client address before authentication. Default 100.

    Requests per second the gateway accepts from one client address before authentication. Default 100.

    values: 1 to 100000

  • GATEWAY_STATIC_RATE_LIMIT_PER_SECOND500Rate limit for dashboard static assets. Default 500.

    Rate limit for dashboard static assets. Default 500.

    values: 1 to 100000

  • GUARDIAN_ALERT_RENOTIFY_INTERVAL86400Seconds before an alert rule that keeps firing notifies again, or 'off'. Default 86400 (1 day).

    Seconds before an alert rule that keeps firing notifies again, or 'off'. Default 86400 (1 day).

    values: seconds or 'off'

  • GUARDIAN_ALLOWED_INTERNAL_TARGETSCIDR ranges and IP addresses Guardian may scan internally. Empty refuses all internal targets.

    CIDR ranges and IP addresses Guardian may scan internally. Empty refuses all internal targets.

    values: comma-separated CIDRs/IPs

  • GUARDIAN_BASE_URLDashboard URL for links in Guardian emails. Empty means no links in emails.

    Dashboard URL for links in Guardian emails. Empty means no links in emails.

    values: https://domain

  • GUARDIAN_CONTACTS_SECRETSecret for guardian-worker to ask identity who may be emailed about a team. Separate from GATEWAY_INTERNAL_SECRET.

    Secret for guardian-worker to ask identity who may be emailed about a team. Separate from GATEWAY_INTERNAL_SECRET.

    values: 32-byte hex string

  • GUARDIAN_DEFAULT_FROM_EMAILDefault from email for Guardian notifications.

    Default from email for Guardian notifications.

    values: email address

  • GUARDIAN_EMAIL_HOSTSMTP host for Guardian email notifications. Empty means no email sent.

    SMTP host for Guardian email notifications. Empty means no email sent.

    values: SMTP hostname

  • GUARDIAN_EMAIL_HOST_PASSWORDSMTP password for Guardian email.

    SMTP password for Guardian email.

    values: password

  • GUARDIAN_EMAIL_HOST_USERSMTP username for Guardian email.

    SMTP username for Guardian email.

    values: username

  • GUARDIAN_EMAIL_PORTSMTP port for Guardian email. Usually 587 (STARTTLS) or 465 (TLS).

    SMTP port for Guardian email. Usually 587 (STARTTLS) or 465 (TLS).

    values: port number

  • GUARDIAN_EMAIL_USE_SSLUse TLS from start for Guardian email (usually port 465).

    Use TLS from start for Guardian email (usually port 465).

    values: true, false

  • GUARDIAN_EMAIL_USE_TLSUse STARTTLS for Guardian email (usually port 587).

    Use STARTTLS for Guardian email (usually port 587).

    values: true, false

  • GUARDIAN_RATE_LIMIT_USER1000/hourPer-user rate limit for Guardian API under gateway's per-team limit. Format: count/period (second, minute, hour, day) or 'off'. Default 1000/hour.

    Per-user rate limit for Guardian API under gateway's per-team limit. Format: count/period (second, minute, hour, day) or 'off'. Default 1000/hour.

    values: count/period or 'off'

  • GUARDIAN_SECRET_KEYSecret key for Guardian service (Django). Required in production.

    Secret key for Guardian service (Django). Required in production.

    values: random string

  • GUARDIAN_TEAM_MEMBERSHIP_MAX_AGE_DAYS30Days a user stays a team member in Guardian without making a request (1-365). Default 30.

    Days a user stays a team member in Guardian without making a request (1-365). Default 30.

    values: 1-365

  • INITIAL_ADMIN_EMAILEmail of the first administrator account created on startup. User must set this value.

    Email of the first administrator account created on startup. User must set this value.

    values: valid email address

  • INITIAL_ADMIN_PASSWORDPassword for the first administrator. Generated randomly by make generate-secrets.

    Password for the first administrator. Generated randomly by make generate-secrets.

    values: randomly generated

  • JWT_SECRET_KEYSigning key for JWT tokens issued by identity service. Must match across all services. Generate with: openssl rand -hex 32

    Signing key for JWT tokens issued by identity service. Must match across all services. Generate with: openssl rand -hex 32

    values: 32-byte hex string

  • LOG_LEVELINFOLog level for services. Default INFO.

    Log level for services. Default INFO.

    values: DEBUG, INFO, WARNING, ERROR

  • NEXT_PUBLIC_GATEWAY_URLBrowser API origin. Empty means dashboard calls API on origin it was loaded from. Set only when dashboard served from different origin than gateway.

    Browser API origin. Empty means dashboard calls API on origin it was loaded from. Set only when dashboard served from different origin than gateway.

    values: https:// origin

  • NEXT_PUBLIC_USE_GATEWAYtrueWhether dashboard uses gateway for API calls. Default true.

    Whether dashboard uses gateway for API calls. Default true.

    values: true, false

  • POSTGRES_PASSWORDPostgreSQL superuser password. All service DATABASE_URLs inherit from this. Generate with: openssl rand -base64 32

    PostgreSQL superuser password. All service DATABASE_URLs inherit from this. Generate with: openssl rand -base64 32

    values: base64 string

  • PROMETHEUS_EXTERNAL_URLhttp://127.0.0.1:9090Address Prometheus UI is reached at for alert links. Default http://127.0.0.1:9090.

    Address Prometheus UI is reached at for alert links. Default http://127.0.0.1:9090.

    values: URL

  • RATE_LIMIT_PER_HOUR10000Per-team request budget enforced at the gateway, in requests per hour. Default 10000.

    Per-team request budget enforced at the gateway, in requests per hour. Default 10000.

    values: 1 to 1000000000

  • REDIS_MAXMEMORY1gbRedis memory ceiling. Instance holds authoritative state with noeviction policy. Default 1gb.

    Redis memory ceiling. Instance holds authoritative state with noeviction policy. Default 1gb.

    values: memory size string

  • REDIS_MEMORY_LIMIT2gContainer memory limit for Redis. Should be at least twice REDIS_MAXMEMORY. Default 2g.

    Container memory limit for Redis. Should be at least twice REDIS_MAXMEMORY. Default 2g.

    values: memory size string

  • REDIS_PASSWORDRedis password. Required by all services. Compose fails to start without it. Generate with: openssl rand -base64 32

    Redis password. Required by all services. Compose fails to start without it. Generate with: openssl rand -base64 32

    values: base64 string

  • SENSOR_API_KEYAuthenticates callers of the sensor's local API. Without it the sensor starts but answers 503 on every route except /health.

    Authenticates callers of the sensor's local API. Without it the sensor starts but answers 503 on every route except /health.

    values: random string

  • SENSOR_DATA_LAKE_API_KEYPersonal API key (data:ingest scope) of the team member created for the sensor. Empty means sensor runs but forwards nothing.

    Personal API key (data:ingest scope) of the team member created for the sensor. Empty means sensor runs but forwards nothing.

    values: API key string

  • SENSOR_DATA_LAKE_CA_BUNDLE/etc/ssl/wildbox/wildbox.crtGateway certificate path for sensor to trust. Default /etc/ssl/wildbox/wildbox.crt. Empty uses system trust store.

    Gateway certificate path for sensor to trust. Default /etc/ssl/wildbox/wildbox.crt. Empty uses system trust store.

    values: file path or empty

  • SENSOR_DATA_LAKE_ENDPOINThttps://open-security-gatewayGateway HTTPS address as sensor reaches it. Default https://open-security-gateway.

    Gateway HTTPS address as sensor reaches it. Default https://open-security-gateway.

    values: HTTPS URL

  • SENSOR_DATA_LAKE_SENSOR_IDopen-security-sensorSensor name in data service, unique within team. Default open-security-sensor.

    Sensor name in data service, unique within team. Default open-security-sensor.

    values: string

  • SLACK_WEBHOOK_URLSlack incoming webhook URL for weekly executive report from automations.

    Slack incoming webhook URL for weekly executive report from automations.

    values: webhook URL

  • TOOLS_ALLOWED_INTERNAL_TARGETSCIDR ranges, IP addresses, and host names the network tools may scan. Empty refuses all internal targets.

    CIDR ranges, IP addresses, and host names the network tools may scan. Empty refuses all internal targets.

    values: comma-separated CIDRs/IPs/hostnames

Wildbox releases & version history

Even more releases RSS

More in Security

Rate this project

Click to rate — no account needed.

0 comments

Posting as guest
Loading comments…