How it works
From signal to report, in five steps.
A structured, repeatable process, with a person reviewing the result.
- Security signalsVerakase starts from security telemetry your team already collects, such as Wazuh alerts and events.
- InvestigationIt gathers the events around a lead within a defined time window, following a fixed and repeatable sequence.
- Evidence contextRelated activity is added: logins, processes, files, network connections and host context.
- FindingsEvents are connected, and each connection is labeled by how strongly the evidence supports it.
- Forensic reportThe result is a structured report for analyst review, with limitations stated plainly.
Evidence labels
Every connection says how it’s known.
Verakase doesn’t reduce an investigation to a single “related” flag. Each link carries one of four labels.
Direct
Linked by a shared identifier in the data.
Plausible
Suggested by the data, but not confirmed.
Context
Useful background, not part of the chain.
Inconclusive
The data can’t settle it either way.
Principles
Designed to be checked, not just trusted.
Read-only by design
Investigations read security data. They don’t change endpoints, accounts or your Wazuh configuration.
Evidence stays separate from interpretation
What the data shows and what an analyst concludes are written as different things.
Limitations are stated
If data is missing, the report says so instead of filling the gap.
AI assists, rules control
AI helps interpret and write. Fixed rules handle the evidence, its order and its limits.
People decide
Analysts review the assessment and choose what to do. Nothing is remediated automatically.
Integration
Works with Wazuh security telemetry.
Verakase reads the alerts and events your Wazuh deployment already collects. It doesn’t modify agents, rules or the data itself.
Wazuh is named to describe a supported telemetry source. It doesn’t imply endorsement.
Early access
We’re building Verakase now.
Talk to us about your investigation workflow.