TriageWall GitHub
v0.4 AGPL-3.0 Self-hosted

Security alerts,
triaged on hardware
you control.

TriageWall turns high-volume Suricata and actionable Wazuh alerts into a source-aware investigation queue. Deterministic policy handles repeat noise; a local security model reasons over what remains.

Get started Release notes

No cloud model. No telemetry. Read-only with respect to your sensors.

TriageWall v0.4 overview showing local policy resolution, analyst outcomes, and pipeline health
Real v0.4 interface · sanitized demo workspace

Twenty-second product tour

From volume to investigation.

See the overview, multi-source queue, bounded search, and source-aware investigation view using sanitized fixture data.

TriageWall v0.4 demo moving from overview to queue search and an alert investigation
99%+typical prefilter ratio after tuning
6–13KSuricata alerts per hour sustained
7–10slocal model latency on an RTX 4060
266alert operator evaluation baseline

The operating model

Two tiers, because neither tier is enough alone.

Signature matching is fast and context-free. A local model is contextual and slow. TriageWall places them in series and keeps the operator in the final decision loop.

01

Deterministic policy

Resolve known noise cheaply.

Validated, scoped Suricata rules can match direction, CIDR, protocol, ports, and private asset context. Missing context fails open to normal model review.

  • Microsecond hash lookups
  • No inference cost
  • Explicit operator-owned reasoning
02

Local model

Reason over the long tail.

Residual Suricata evidence and admitted Wazuh alerts pass through source-specific isolation before a local Ollama model returns a verdict, confidence, and reasoning.

  • Real, false positive, or uncertain
  • Source and agent provenance retained
  • Operator feedback recorded

Architecture

A triage layer, not another sensor.

TriageWall reads what your existing tools already detect. It does not block traffic, modify sensor rules, or replace Wazuh or Suricata.

  1. 01
    Read local streams

    Tail Suricata eve.json and, optionally, a same-host Wazuh alerts.json volume with durable checkpoints.

  2. 02
    Project by source

    Build a bounded Suricata or Wazuh evidence shape. Untrusted strings stay data, not instructions.

  3. 03
    Classify locally

    Use deterministic policy where it applies and a local Ollama model for the residual queue.

  4. 04
    Review with context

    Persist the verdict beside source provenance, model reasoning, and revisioned exact-IP asset snapshots.

Hostile-input boundary

The alert stream can write text into the prompt.

TriageWall treats sensor evidence as attacker-controlled input. The shipped classifier combines source-specific projection, value encapsulation, a strict three-field response contract, and a per-process canary check.

Read the threat model
Bounded evidenceUnknown or oversized input cannot silently expand the model boundary.
Strict outputMalformed, partial, or extra-field responses become uncertain at zero confidence.
Canary checkRaw and decoded output are checked before a decision is accepted.
Local processingTelemetry stays on infrastructure the operator controls.

v0.4 release evidence

Evidence, not a maturity costume.

The release boundary was exercised and documented. The project also states what has not been validated instead of turning it into a green badge.

PASSFresh installation

Core starts through its single-owner migration phase and serves a healthy local pipeline.

PASSProduction deployment

The final application build ran on the production-scale retained database with no monitoring gap.

PASSCore + Wazuh

Both checkpoints advanced throughout the observation window with zero service restarts.

PASSBounded search

Signature, IP, asset, pagination, and investigation navigation passed; an absent term returned in 0.042 seconds.

PASSConfiguration lifecycle

Authorization, preview, activation, reload, concurrency, and rollback paths are regression-gated.

DECLAREDKnown boundaries

Model accuracy remains the approved 266-alert baseline; v0.4 does not claim a new model evaluation.

Read release evidence v0.4 release notes

Evaluate it yourself

Start with demo data.

No sensor or production stream is required for a first look. The default stack includes a demo mode so you can inspect the workflow before granting access to anything real.

Docker Compose v2 Ollama 8 GB+ VRAM recommended
quick start
$ git clone https://github.com/aaronphifer/triagewall.git
$ cd triagewall
$ cp .env.example .env
$ docker compose up -d

Set DEMO_MODE=true, then open localhost:8084.

TriageWall v0.4

Keep the telemetry. Review the signal.

Free, open source, and built in public for operators who already self-host their security stack.

Get started Read the build notes