FAQ

FAQ

What does Wildbox actually do?

Aggregates threat intelligence from 50+ sources, monitors cloud posture on AWS, Azure and GCP, manages the vulnerability lifecycle, automates incident response with YAML playbooks, collects endpoint telemetry, and applies LLMs to analysis and reporting. Self-hosted, so the data stays yours.

Can I run only the part I need?

Partly. The services are independent processes behind a gateway, but the default docker compose up starts all of them except automations. You can comment out what you do not want, keeping in mind that the gateway, identity and PostgreSQL are load-bearing for everything else. automations is already optional and behind a profile.

The issue counter looks alarming. Is the project drowning?

No, and the counter is misleading by construction: GitHub's open_issues_count includes pull requests. Nearly every open pull request here is a Dependabot dependency bump, and the number of real open issues is small. Check the two separately rather than trusting the badge:

• open issues, excluding pull requests
• open pull requests

Dependency bumps arriving faster than they are merged is a maintenance backlog, not a pile of unresolved bugs.

What does "in development" mean for cspm and sensor?

That the feature surface is incomplete, not that the container is absent. Both are defined in the default compose file and do start, although the README describes them as not enabled. Treat the maturity warning as accurate and the "not enabled" part as out of date.

How much hardware does it need?

8 GB of RAM minimum, 16 GB recommended. That is eleven services plus PostgreSQL and Redis, each in its own container. Below the minimum you get containers killed in ways that look like unrelated bugs.

Why can I not reach a service from another machine?

By design. Only the gateway binds beyond localhost; every other published port is bound to 127.0.0.1, and PostgreSQL and Redis publish nothing. Go through the gateway, or open an SSH tunnel for local debugging. See Service map.

Does it need OpenAI?

Only the agents service uses an LLM, for analysis and report generation. Everything else works without it. The repository has been standardising its LLM configuration, so check .env.example for the variable names your version expects rather than assuming.

Where do I report a security problem?

Privately, through SECURITY.md. Never in a public issue. This platform holds cloud credentials and endpoint telemetry, so a public report is an invitation.

Is it ready for production?

It is a 0.x, and the release history is the honest answer. v0.8.0 closed a three-round security audit and added JWT revocation, account lockout and network segmentation. v0.9.0 went further and is worth knowing about before you rely on any single tool: fourteen catalog tools had been fabricating their results with random. Nine were rewritten to do real work, five were removed outright (compliance_checker, security_compliance_checker, incident_response_automation, threat_hunting_platform, social_media_osint), and the catalog went from 59 tools to 54. The same release fixed a privilege escalation on the identity admin endpoints and purged three committed credentials from the repository history.

That is a serious posture for a 0.x, and it is still a 0.x. Pilot it, read SETUP_GUIDE.md for the production path, and read the v0.9.0 upgrade notes if you are coming from v0.8.0: split-origin deployments need a gateway CORS allowlist entry, and container_security_scanner now requires Trivy rather than inventing findings when it is absent.