Anveesa Mikko: a SOC platform that replaces the Wazuh dashboard
Documentation for Anveesa Mikko, a self-hosted SOC platform that replaces the Wazuh dashboard with threat hunting, case management, active response, and a live correlation engine.
Overview
Mikko is a focused SOC console on top of your Wazuh stack: Wazuh's brain, your face. It never re-indexes Wazuh data. Alerts, agents, vulnerabilities, SCA, and MITRE coverage are fetched live from the Wazuh API and indexer, so nothing is duplicated. The backend is Rust with a Vue 3 interface, and runs with Docker Compose.
Threat hunting
Attacker-centric pivot by source IP: ranked attackers, per-IP profiles with a timeline, targeted agents, MITRE ATT&CK techniques, raw payloads, and VirusTotal and AbuseIPDB links.
Correlation engine
A background task continuously correlates the live event stream into higher-order threats such as campaigns, floods and surges, and can block attackers automatically when armed.
Cases and active response
Incident cases with observables, append-only timelines, status workflows, and escalation from detections or threat hunts. Block attacker IPs through Wazuh's active response.
Security
Argon2 passwords, stateless JWT, mandatory TOTP MFA, and role-based access (admin, analyst, viewer) with per-action gates.
Questions people ask
What is Anveesa Mikko?
Mikko is a SOC platform that replaces the Wazuh dashboard. It keeps Wazuh as the engine and gives your analysts threat hunting, a live correlation engine, case management and active response on top.
Does Mikko copy or re-index my Wazuh data?
No. Alerts, agents, vulnerabilities, SCA and MITRE coverage are read live from the Wazuh API and indexer. Mikko stores only its own state, such as cases and detections.
What do I need to run Mikko?
An existing Wazuh stack and a host with Docker Compose. The Rust backend idles well under 50 MB of memory; plan for 512 MB if PostgreSQL runs on the same host.
Can Mikko block an attacker automatically?
Yes, through Wazuh's active response, but it ships disarmed. You review the simulated audit log and add your own IP ranges to the allowlist before you arm it.
Is Mikko open source?
No. Mikko is licensed to teams. Write to pandhuw58@gmail.com to talk about a license.