Proof your SIEM isn't silently blind.
Your Wazuh dashboard can be green while events are being dropped, filebeat is stalled, or the indexer has gone read-only. IngestProof checks every client pipeline end to end and tells you before your client finds out.
Request a free 30-day pilot See how it works"Up" is not the same as "working"
Uptime checks and API polls miss the failures that actually cost you. These are real failure modes we have reproduced in fault-injection tests on Wazuh 4.x:
Service "active", daemons dead
The manager unit reports active while wazuh-db or analysisd has died. Nothing alerts, because the thing that alerts is down.
Events dropped under load
Analysisd queues fill and UDP syslog overflows. Events are discarded with no visible error, sometimes most of them.
Filebeat stalled
Alerts are generated but never reach the indexer. The dashboard just shows a quiet day.
Indexer read-only
Disk watermarks flip indices to read-only. Ingestion stops, and nobody notices until a client asks for an investigation.
How it works
A small agent runs next to each manager and reports health signals to IngestProof over outbound HTTPS. You don't open any inbound ports or install any agent on endpoints.
- End-to-end canaryEvery few minutes a marker event is injected and must become searchable in the indexer in time. One check covers the whole pipeline.
- Silent-failure checksDaemon state, queue drops, remoted and UDP loss, filebeat progress, indexer blocks and disk watermarks.
- Ingestion completenessA per-client percentage of events actually processed, ready to put in an SLA report.
- Out-of-band alertsEmail, Slack, Telegram, or PagerDuty, sent from outside the cluster so they still fire when Wazuh is down.
One view across every client:
Health metrics only. Never your data.
IngestProof never sees log content, alerts, or client data. It receives counters and check results, which keeps your data processing agreement short and your clients' security teams comfortable.
| What we receive | What we never receive |
|---|---|
| Daemon status, queue usage, drop counters | Log lines or event payloads |
| Canary arrival time | Alerts or rule matches |
| Indexer health, disk watermarks | Agent inventories, endpoint hostnames or IPs |
Simple pricing
Priced per cluster, not per analyst seat. Pilots are free for 30 days.
Single
- All checks and canary
- Email and Slack alerts
- For in-house SOC teams
MSSP
- Up to 10 client clusters
- Completeness % per client
- Monthly SLA report per client
- All alert channels
MSSP+
- Up to 30 client clusters
- White-label client reports
- Priority support
FAQ
Which versions are supported?
Wazuh 4.x is supported now, and 5.x support is being developed alongside the 5.0 release candidates.
Does it replace my SOC platform?
No. IngestProof works next to the Wazuh dashboard, CoPilot, IRIS, or whatever you already use. It answers one question: is the pipeline actually delivering events?
Is the agent open source?
Yes. The detection rules and probe are open source, so you can read exactly what runs on your manager. The hosted dashboard, alerting and reports are the paid service.
What happens if IngestProof itself goes down?
Missing heartbeats are treated as an alert condition, and the local probe keeps alerting on its own without the hosted service.
Find out what your pipeline is hiding
We're onboarding a small number of MSSPs for free 30-day pilots on one cluster, in exchange for honest feedback.
Request a pilot