Priced per cluster. Not per analyst.
Every plan starts with a free 30-day pilot. No card, no commitment, and you only pay if you decide to keep it.
Single
For an in-house SOC running its own Wazuh.
per cluster
- Every check, including the canary
- Dead man's switch for silent managers
- Webhook alerts: Slack, ntfy or any HTTPS endpoint
- 30-day completeness %
MSSP
For providers running Wazuh for their clients.
up to 10 client clusters
- Everything in Single
- One dashboard across all clients
- Completeness % per client
- Alert routing per client (coming soon)
- Monthly SLA report per client (coming soon)
MSSP+
For larger client bases.
up to 30 client clusters
- Everything in MSSP
- Priority support
- Help tuning thresholds per client
- White-label client reports (coming soon)
More than 30 clusters? Talk to us about volume pricing. Prices exclude VAT.
One missed incident costs more than a year of this.
If a client's pipeline goes quiet for a weekend and an attack lands in that gap, the question won't be which tool failed. It will be why nobody noticed. IngestProof makes sure somebody does, and gives you the evidence that monitoring was working the rest of the time.
Questions
What counts as a cluster?
One Wazuh manager installation with its indexer: the thing you install the agent on. A multi-node manager cluster counts once per manager node you want watched.
What happens after the pilot?
Nothing automatic. Near the end we have a short call about what it caught and what it missed. If you want to keep it, you pick a plan. If not, run the uninstall command and that's it.
Which Wazuh versions are supported?
Wazuh 4.x today. Support for 5.x is on the roadmap as 5.0 moves through its release candidates.
Does it replace my SOC platform?
No. It runs next to the Wazuh dashboard, CoPilot, IRIS or whatever you already use, and answers one question: is the pipeline actually delivering events?
What if IngestProof itself has an outage?
The agent keeps its reports and replays them when the service is back, so your completeness figures stay accurate. Every check result is also written into Wazuh through the agent's local rules, so your own alerting keeps working in the meantime.
Can I cancel any time?
Yes. Plans are monthly. Cancel, run the uninstall command, and you're done.
Try it on your clusters first.
30 days free. A real person replies within one working day.
Start a free pilot