Founding Partners Wanted: An Open-Source SOC Platform on Wazuh, DFIR-IRIS and Shuffle

Most mid-sized companies have the same problem. The firewall, the hypervisor and the domain controllers all produce logs, nobody has time to read them, and a commercial SIEM priced per alert or per gigabyte feels like paying a toll to look at your own data.

simpliSOC is our answer: an open-source security operations platform that runs on your own infrastructure. It is in production, and we are now opening a founding-partner program for the first organisations that want to deploy it.

This post covers what you would be getting, what is not included, and how to join.

Who this is for

• Teams with a FortiGate, VMware ESXi and Windows Active Directory estate who want detections that already understand those sources.
• Companies that want logs to stay on their own infrastructure, on-premise or in a private cloud.
• Organisations already running Wazuh that have alerts but no case workflow, no deduplication and no health monitoring around it.
• IT and security teams of one to five people who need a SOC workflow without buying a platform designed for a 50-analyst team.
• Integrators and MSPs who want a stack they can inspect, modify and deploy for clients without per-alert licensing.

What is live today

Everything below is running in production. Nothing here is a slide.

The pipeline, end to end.

1. Ingest. Syslog over UDP from FortiGate firewalls, VMware ESXi, Windows endpoints with Sysmon, and Windows AD domain controllers.
2. Detect. Wazuh 4.x decodes and correlates events against more than 50 custom rules, plus IOC lists for IPs, domains and hashes refreshed from live threat feeds (Feodo Tracker, URLhaus, ThreatFox) without a restart.
3. Route. The SOC Integrator, a custom FastAPI service and the only proprietary component, polls the Wazuh indexer, deduplicates, applies exceptions, maps severity, and creates DFIR-IRIS alerts idempotently.
4. Respond. Analysts work structured cases in DFIR-IRIS. Optional Shuffle playbooks handle enrichment (for example VirusTotal), notifications and, if you choose, containment.

flowchart TD
    A["Syslog sources - FortiGate, ESXi, Windows and Sysmon, AD"] --> B["Wazuh - decode and correlate"]
    T["Threat feeds - Feodo, URLhaus, ThreatFox"] --> B
    B --> C["SOC Integrator - dedup, exceptions, severity mapping"]
    C --> D["DFIR-IRIS - alerts and cases"]
    D --> E["Shuffle playbooks - optional"]
    E --> F["Slack, LINE, PagerDuty, email"]

Detection coverage. IOC and threat intel matching, FortiGate firewall and IPS, FortiGate VPN (IPsec and SSL), Windows AD and authentication, VMware ESXi, log and Sysmon monitoring, and multi-stage correlation rules.

Operations features. Per-rule dedup cooldowns, alert exceptions through a REST API, a configurable minimum severity, log-loss monitoring, and an operations console that shows service reachability and pipeline health. The API is documented with Swagger UI.

Optional AI-assisted triage. A local LLM, served from an OpenAI-compatible endpoint such as Ollama, llama.cpp, vLLM or LocalAI, adds a plain-language explanation and a true or false positive assessment to qualifying alerts. It is advisory only. It does not close, merge or suppress alerts. If you want to know how we think about AI in a SOC, read why AI for SOC mostly doesn’t work and what does.

Deployment. On-premise or private cloud, with Docker Compose and a single script for the full-stack setup. No per-alert pricing and no vendor lock-in.

To see how we built it, read the field report on building a SOC from scratch with Wazuh and IRIS-web.

What is not included, so you can plan around it

• Coverage is for the sources listed above. Other log sources (other firewall vendors, Linux servers, SaaS audit logs, OT networks) need new decoders and rules. We scope that work with you, we do not assume it works out of the box.
• It is a platform, not an outsourced analyst team. The page does not promise 24/7 analyst monitoring, and neither does this post. Who operates it day to day is something we agree with you during scoping.
• No compliance certification is claimed. The platform keeps data on your infrastructure and gives you the audit trail of cases and alerts. Whether that satisfies a particular framework is for your auditor to decide.
• There is no public demo environment. The way to evaluate it is a coverage assessment against your own log sources, described below.
• Shuffle automation and containment are optional and off unless you turn them on.

What founding partners get

• A log-source and coverage assessment. You tell us what you run, we tell you which detections apply today and which would need new work.
• A scoped proposal with shipped features and roadmap items clearly separated.
• Priority onboarding for your first deployment.
• A direct line to the engineers who built it, in Bangkok time, by LINE, WhatsApp, phone or email.
• A say in the roadmap. What we build next is shaped by the first teams who run it.

Commercial terms for founding partners are agreed with you in the proposal. We do not publish a fixed founding discount, and the platform itself has no per-alert pricing.

How to join

1. Read first. The simpliSOC page has the stack and architecture, and the field report shows what a real deployment looks like.
2. Tell us what you run: firewall and hypervisor vendors, whether you use Windows AD, and roughly how many endpoints.
3. Get a coverage assessment and a scoped proposal, then decide.

Email us to become a founding partner

Prefer chat? LINE: iiitum1984, WhatsApp: +66 83 001 0222, or call +66 97 496 6397.

FAQ

Is simpliSOC really open source?
The stack is built on open-source components: Wazuh, DFIR-IRIS and Shuffle. The SOC Integrator that connects them is a custom FastAPI service and is the only proprietary component.

Do I need Shuffle?
No. Shuffle, the SOAR layer, is optional. The core path from Wazuh through the integrator to DFIR-IRIS works without it.

Does the AI close alerts for me?
No. The optional local LLM only adds an explanation and a true or false positive assessment. A human decides.

Can it run without sending logs to the cloud?
Yes. It is designed for on-premise or private cloud deployment, and your data stays on your infrastructure.

Which notification channels work?
Slack, LINE, PagerDuty and email are supported through integrations, along with REST APIs.

Is there a fixed founding-partner discount?
We do not publish one. Terms are scoped per partner in the proposal.

Can you monitor it for us 24/7?
This post does not promise that. If you need an operating model beyond the platform itself, raise it in the first conversation and we will scope it honestly.