For Wazuh 4.x · iPhone · In development
Your Wazuh alerts on your iPhone, straight from your own server.
SIEM Dashboard for Wazuh connects your iPhone directly to the Wazuh deployments you already run. It reads alerts and agent status from the Wazuh indexer with a read-only user. There is no cloud service in between: your alerts travel only from your server to your phone.
Coming soonon TestFlight and the App Store
See how it connectsNo account · no analytics · no tracking
Why it's different
Direct to your Wazuh
The app talks to your indexer, usually over a VPN you already use. Nothing is relayed through us.
Read-only by design
Connect with a read-only user. The app reads alerts and agent status and never changes your Wazuh configuration.
All your deployments
Production, lab, a customer's setup: add each one with its own URL, credentials and TLS trust, and switch with a tap.
Private by default
No account, no analytics, no tracking. We receive none of your data.
In the app
The last 24 hours at a glance
A ring with one arc per severity band, your agents with their status, and a timeline you can filter and search.
Screenshots from the current development build. The interface may still change before release.
How it connects
Your phone, your server, nothing in between
The app connects only to the URLs you enter. A typical setup keeps Wazuh private and reaches it through a VPN such as Tailscale or WireGuard.
- Wazuh indexeralerts · default port 9200
- Wazuh manageroptional · posture reporting · port 1514
- Companion serviceoptional · push and SOAR runs
Create read-only users
In Wazuh, create an indexer user that can only read the wazuh-alerts-* and wazuh-monitoring-* indices.
Make Wazuh reachable from your phone
Usually through the VPN you already run. Wazuh does not need to be exposed to the internet.
Add a deployment in the app
Enter the indexer URL and the credentials, and optionally the dashboard URL for "Open in Wazuh" links. Pin the certificate of Wazuh's self-signed setup, or rely on a public CA.
Watch your alerts
Alerts and agent status load straight from your server. Add more deployments and switch between them at any time.
Features
Built for triage on the go
Severity bands (Wazuh rule level)
- Critical
- level ≥ 12
- High
- level 9–11
- Medium
- level 5–8
- Low
- level < 5
Alerts by severity
A 24-hour overview split into four bands, so the two critical alerts don't drown in thousands of low ones.
Filters and search
Filter by band or agent, and search by rule, agent, IP address or description.
Alert detail with MITRE ATT&CK
The full log line, decoded fields, rule groups and the MITRE ATT&CK tactics and techniques of the rule.
Agents and their status
See your Wazuh agents and whether each one is active or disconnected.
Mute noisy rules
Hide a noisy rule in the app for a while. Muting happens on your phone only; your Wazuh rules stay untouched.
Several deployments
Keep production, lab and customer deployments side by side, each with its own URL, credentials and TLS settings.
Credentials in the Keychain
Usernames and passwords are stored in the iOS Keychain, on this device only. They are not synced and are sent only to your own server.
TLS trust you control
Pin the certificate of Wazuh's self-signed setup, so the app trusts exactly that certificate, or use one from a public CA.
Optional add-ons
Go further if you want to
- Optional
Companion service: push and SOAR runs
A small read-only container you run next to Wazuh. It adds push notifications for critical alerts and shows your SOAR playbook runs (SOARCA, CACAO v2) in the app.
- Optional
Your iPhone as a Wazuh agent
Wazuh has no iOS agent. Turn this on and the app reports your iPhone's security posture to your own Wazuh using the Wazuh agent protocol: iOS version, passcode, signs of a jailbreak, VPN and proxy, and network status.
Requirements
What you need
Wazuh 4.x
A stock deployment with the Wazuh indexer.
Read-only access
An indexer user with read access to the wazuh-alerts-* and wazuh-monitoring-* indices.
A network path
Your iPhone must reach both endpoints, typically through a VPN.
An iPhone
Running iOS 17 or later.
For the companion (optional)
A host next to Wazuh that can run a container.
FAQ
Questions and answers
Do my alerts pass through your servers?
No. The app connects only to the URLs you enter. We run no backend for it and never receive your alerts, credentials or server addresses. If you use push notifications from the companion service, the notifications are delivered through Apple's push service.
Do I have to expose Wazuh to the internet?
No. The recommended setup keeps Wazuh private and reaches it through a VPN such as Tailscale or WireGuard. Your phone only needs to reach the indexer.
Can the app change anything in my Wazuh?
Not with a read-only user, which is what the app is meant to be used with. It reads alerts and agent status. Muting a rule only hides it in the app.
Does it work with Wazuh's self-signed certificates?
Yes. Pin the certificate of your deployment and the app trusts exactly that certificate. A certificate from a public CA works as well.
Which Wazuh versions are supported?
Stock Wazuh 4.x with its indexer.
Is this an official Wazuh app?
No. It is an independent app by sp33c.tech and is not affiliated with or endorsed by Wazuh, Inc.
When can I try it, and what will it cost?
A TestFlight beta is coming soon. Pricing will be announced before the App Store release. Write to us if you'd like to hear when the beta opens.
Take your SIEM with you
SIEM Dashboard for Wazuh is in development. Questions, or want to hear when the beta opens? Get in touch.
Coming soonon TestFlight and the App Store
Contact support