An open-source Stellar Cyber alternative, built on Wazuh

What each platform is

Stellar Cyber sells AI-driven Open XDR for MSSPs and lean enterprise security teams. One license bundles its NG-SIEM and data lake with UEBA, NDR with a malware sandbox, a threat intelligence platform, IDS, and SOAR-style orchestration. Vendor materials describe multi-tier multi-tenancy, with MSSPs managing thousands of end customers under a single license.

SocTalk is one open-source control plane that provisions a dedicated Wazuh manager and indexer per customer on your Kubernetes, or attaches to a Wazuh deployment you already run. The data plane is Wazuh-only today.

Deployment

Both are self-hostable. Stellar Cyber runs in any public cloud (AWS, Azure, GCP, OCI), on premises on your hardware or its appliances, or hybrid, with per-site data residency controls. SocTalk installs on stock Kubernetes 1.30+, from single-node k3s to EKS, AKS, and GKE, with air-gap support. A demo VM boots in five minutes, and a production install takes about an hour.

Endpoint layer

Stellar Cyber's posture is bring your own EDR, with 32 bi-directional integrations the vendor maintains, including CrowdStrike, SentinelOne, and Microsoft Defender. SocTalk's endpoint layer is the Wazuh agent, with no third-party EDR integrations today. If BYO EDR is central to your practice, this favors Stellar Cyber.

Licensing and cost

Stellar Cyber is quote-based and licensed by asset: each asset license includes 60 MB per day of ingest, averaged across all assets, and overage converts into additional asset licenses. 'One Platform, One License' puts every capability in each license; MSSP wholesale mechanics are not published.

SocTalk has no license fee and no license-metered ingest cap. Control plane, AI pipeline, Wazuh integration, and Helm charts are all Apache 2.0, no community versus enterprise split, no feature gates. Costs are infrastructure plus LLM tokens and vary widely. A documented order-of-magnitude example lands near $9 per day per tenant at 30 alerts per day; local Ollama takes per-token cost to zero.

AI posture

Stellar Cyber describes a 'Human-Augmented Autonomous SOC' whose agentic AI triages alerts, builds threat narratives, and writes case summaries, positioned as AI-driven decisioning with human oversight. SocTalk runs a deterministic funnel first; many alerts never reach a model, and the LLM only routes and issues the verdict. Escalations are always human-reviewed, containment always needs analyst approval, and tenants bring their own LLM, fully local Ollama included.

Where Stellar Cyber is the better fit

If you want the whole detection stack from one supported vendor, Stellar Cyber ships that today. SocTalk covers a narrower job, triage and response on Wazuh, leaving pieces like Cortex enrichment or TheHive case export as integrations you operate.

Where customer estates already standardize on a third-party EDR, Stellar Cyber consumes that telemetry through integrations its own team maintains. SocTalk offers no equivalent today.

By its own December 2025 announcement, a third of the top 250 MSSPs run Stellar Cyber; the company holds ISO 27001 certification, announced March 2025, and offers SOC 2 reports through its security portal. SocTalk is a young v0.1.x open-source project with no vendor certifications. Its docs support SOC 2-style audits, with evidence living on infrastructure you host, but no attestation ships. Buyers who require vendor attestations have them on file at Stellar Cyber and not, today, at SocTalk.

Where SocTalk differs

The license model is the deepest split. Apache 2.0 lets you read, fork, and audit exactly the code you run, with no license enforcement anywhere. Evaluating Stellar Cyber starts with a sales conversation.

Stellar Cyber counts assets and averages ingest; SocTalk meters nothing, so cost lives in your infrastructure and model choices.

Every customer's stack sits in its own Kubernetes namespace, with Postgres row-level security as the backstop and isolation tests required to pass in CI. Tested to ~50 tenants on a 3-node cluster, it is isolation you can demonstrate to an auditor. The AI is gated the same way, with deterministic checks running before any model call.