Kikimora connects to Wazuh so host-level alerts and agent health join your cloud, code, and edge findings in one conversational view.
Triage host detection events from one conversation
The capability covers the host-based detection layer: querying security events and alerts by time window and severity, checking agent coverage and health across your fleet, and pulling that context into an incident timeline. Endpoint detection is often the signal that tells you an exposure was actually used, so having it next to your cloud and network findings turns scattered alerts into a coherent story. Agent coverage is the quiet failure mode here. A detection platform only sees the hosts that still have a healthy agent reporting in, and the machine where the agent stopped is exactly the one you most want eyes on. Asking which agents are offline or stale is as important as triaging the alerts themselves, and the agent treats both as ordinary questions you can ask in the same conversation as the rest of your stack.
What you can do
- Query security events and alerts by time window and severity.
- Check agent coverage and status across your fleet.
- Pull Wazuh context into incident timelines.
Things you might ask
- “Summarize the high-severity Wazuh alerts from the last 24 hours and which hosts triggered them.”
- “Which endpoints have a Wazuh agent that is offline, so we have blind spots in coverage?”
- “Pull every Wazuh event around this host into the timeline for the incident I am building.”
Wazuh provides the host-level detection signal. Pair it with the Sentry integration, which adds application error and exception data, and with the built-in Network Scanner integration to confirm what is actually exposed on the host’s subnet, so detection, application, and exposure all sit in one conversation.