FAQ

FAQ

What does Wildbox actually do?

Aggregates threat intelligence from 50+ sources, monitors cloud posture on AWS, Azure and GCP, manages the vulnerability lifecycle, automates incident response with YAML playbooks, collects endpoint telemetry, and applies LLMs to analysis and reporting. Self-hosted, so the data stays yours.

Can I run only the part I need?

Partly. The services are independent processes behind a gateway, but the default docker compose up starts all of them except automations. You can comment out what you do not want, keeping in mind that the gateway, identity and PostgreSQL are load-bearing for everything else. automations is already optional and behind a profile.

Why are there almost ninety open pull requests?

Because 87 of them are Dependabot. The repository has exactly one open issue at the time of writing. A visitor reading the issue counter sees 89 and reasonably concludes the project is drowning; the counter includes pull requests. Dependency bumps arriving faster than they are merged is a maintenance backlog, not a pile of unresolved bugs.

What does "in development" mean for cspm and sensor?

That the feature surface is incomplete, not that the container is absent. Both are defined in the default compose file and do start, although the README describes them as not enabled. Treat the maturity warning as accurate and the "not enabled" part as out of date.

How much hardware does it need?

8 GB of RAM minimum, 16 GB recommended, for eleven services plus PostgreSQL, Redis and Elasticsearch. Below the minimum you get containers killed in ways that look like unrelated bugs.

Why can I not reach a service from another machine?

By design. Only the gateway binds beyond localhost; every other published port is bound to 127.0.0.1, and PostgreSQL and Redis publish nothing. Go through the gateway, or open an SSH tunnel for local debugging. See Service map.

Does it need OpenAI?

Only the agents service uses an LLM, for analysis and report generation. Everything else works without it. The repository has been standardising its LLM configuration, so check .env.example for the variable names your version expects rather than assuming.

Where do I report a security problem?

Privately, through SECURITY.md. Never in a public issue. This platform holds cloud credentials and endpoint telemetry, so a public report is an invitation.

Is it ready for production?

The current version is v0.8.0, after a security-hardening phase that closed a three-round audit, 35 issues, and nearly all Dependabot alerts, and added JWT revocation, account lockout and network segmentation. That is a serious posture for a 0.x, and it is still a 0.x: pilot it, read SETUP_GUIDE.md for the production path, and do not put the development compose file on a public interface.