Red team on steroids — at SIEM-breaking scale.
Fire massive, realistic attack traffic at Wazuh over TCP syslog — sustaining tens of thousands of events per second from one multi-core engine.
Up and running in three steps.
Define a test
Pick attack scenarios, MITRE techniques, and a saved Wazuh profile to fire at.
Fire across all your cores
A multi-process worker engine fans load across CPU cores for sustained throughput.
Measure detection under load
Track events sent, alerts caught, and MTTD percentiles under real pressure.
Everything in Firehose.
Multi-core load engine
Per-core worker processes push sustained, high-volume traffic from one host.
Realistic attack scenarios
Weighted scenario mixes, multi-stage attack chains, and a Markov-style behavior simulator.
Reusable Wazuh profiles
Saved Wazuh targets — syslog host, alerts source, and tuning — ready to fire.
Detection validation
Confirm your Wazuh pipeline catches attacks and surfaces the right rules under pressure.
Live system metrics
Per-core CPU, throughput, backpressure, and failure tracking in real time.
MTTD percentile reporting
Mean time to detect at p50, p95, and p99 — not just the average.
Common questions.
Stress-test your detections at scale.
See how Firehose pushes your Wazuh pipeline to its limits.