Mobius documentation
Your SOC, on autopilot
Mobius is an agentic SOC for Wazuh. It ingests your alerts, triages every one of them with AI, enriches with MITRE ATT&CK, correlates the escalations into incidents, and can respond — automatically or with your approval.
Every alert triaged
An AI L1 analyst classifies every Wazuh alert: verdict, risk score, MITRE enrichment, and a written rationale — with retrieval over security playbooks for context. No alert fatigue, no sampling.
Escalations become incidents
Escalated alerts are correlated into incidents and reviewed by a deeper L2 pass, so what reaches a human is a coherent story, not a stream of duplicates.
Zero inbound ports
The Mobius connector installs on your Wazuh node and dials out over mTLS. Your indexer credentials never leave the box, and nothing in your network is exposed.
Respond, with control
Incident Response can block an attacker IP on the affected agent through the Wazuh Active Response API — automatically, or held for analyst approval.
Part of the Wazuh Labs ecosystem.