The bottleneck of every Blue Team isn’t intelligence. It’s the time lost switching between tools.
The average SOC analyst uses between 6 and 12 different tools to investigate a single incident.
Opens VirusTotal, then Shodan, then AbuseIPDB, then TheHive to open the case, then Wazuh to view correlated alerts.
Gjallarhorn was built to end that problem. A single platform that centralizes investigation, analysis, forensics, and case management, with all the SOC integrations a Blue Team needs.
Everything a Blue Team analyst needs. In one place.
Every Gjallarhorn module exists because an analyst needed it in production. Not catalog features, real tools for real threats.
IOC Investigation
Enter an IP, domain, hash, or URL and Gjallarhorn crosses it in real time against 20+ threat intelligence sources: VirusTotal, Shodan, AbuseIPDB, AlienVault OTX, GreyNoise, Criminal IP, URLScan, and more. In seconds you get the consolidated score, each source’s verdict, and the team’s complete investigation history. What used to mean copying and pasting between tabs is now a single click.
Malware Analysis
Static analysis of suspicious files without executing them, zero contamination risk. Supports PE files (.exe, .dll, .sys), scripts (.ps1, .bat, .js, .vbs), Office documents, PDFs, and compressed archives. Detects known ransomware signatures, Cobalt Strike beacons, C2 frameworks, obfuscation techniques, and malicious behavior. Each analysis stored with SHA-256 hash, score, and verdict for future correlation.
Email Forensics
Drag in a .eml file and Gjallarhorn dissects it completely. Validates SPF, DKIM, and DMARC authentication. Extracts and analyzes all IOCs in headers, body, and attachments. Detects phishing patterns, BEC (Business Email Compromise), and social engineering. Traces the complete message path across relay servers. What used to take an expert analyst 30 minutes now takes seconds.
Case Management
Every security incident and finding managed in one place: opening, assignment, severity, status, and closure. Bidirectional sync with TheHive, cases created in Gjallarhorn appear automatically in TheHive, and vice versa. Classification by TLP (AMBER, RED, GREEN, WHITE), filters by status and severity, and complete lifecycle traceability for every incident.
Native SOC Integrations
Gjallarhorn connects with the tools you already use. TheHive for case management, Wazuh for SIEM and EDR, Velociraptor for live endpoint forensics, Nessus and OpenVAS for vulnerabilities. Configuration via API key, no additional agents, no complex setups. The dashboard shows the status of each integration in real time and consolidates all events in a unified view.
Correlation and automatic response
When Wazuh or Suricata detect an event, Gjallarhorn investigates the involved IOCs and, if the score exceeds the threshold, opens the enriched case without human intervention. The response is built in a visual playbook editor: steps in order, each with its condition, that notify by email, block the IP in the feed, isolate the compromised host with a Wazuh active response, or launch an OpenVAS scan. The analyst arrives to find the incident already investigated, classified, and contained.
Dynamic analysis sandbox
The suspicious file is detonated in an isolated environment and watched: the processes it spawns, the registry changes it makes, the files it writes and where it tries to connect. It runs against CAPE, and the result comes back with the indicators already extracted and the case opened with the evidence linked, with nothing to load again by hand.
Detection rule editor
What you learn investigating becomes detection. The editor generates Sigma and YARA rules from the indicators in the case, and translates them into the queries of whichever SIEM the organization runs. Investigations stop ending in a report and start leaving a rule behind.
Intelligence sharing
Findings are exported in STIX 2.1, the standard format for sharing threat intelligence, and observed techniques are mapped onto MITRE ATT&CK. Useful for reporting to a CERT, feeding another platform, or showing management which techniques are actually being seen.
Separation by organization
A single installation can serve several organizations with each one’s information fully isolated from the others, with its own integrations and its own API keys. It is what makes it possible to run a SOC for third parties without standing up one instance per client.
Infrastructure monitoring
Finding out that a server stopped responding should not depend on someone picking up the phone. Gjallarhorn checks the devices you point it at on its own, by ping, by port or by web response, and emails you when something goes down and when it comes back. If you already run Zabbix, it integrates with it and brings its devices and its alerts onto the same screen, so nobody has to look at two systems to know whether the network is up. Every device can carry the name your organization uses for it, and a probe reports which operating system it runs and which ports it exposes.
IT asset inventory
Before you can protect something you have to know it exists. Gjallarhorn builds the device inventory out of what your organization already has: what it measures itself, what your Zabbix administers and what is recorded in your GLPI. The same device stays as a single record even when three different tools report it, carrying the serial number one of them provides, the address another provides and the state it measures on its own. When two tools say different things about the same device, it shows you instead of picking one: that gap almost always means the inventory is out of date, and it is information the risk analysis needs.
WAF management
Manage the application firewall (ModSecurity on nginx) of one or several servers from the SOC, without logging in over SSH. An agent on each server is the only component with privileges; Gjallarhorn reads the status, pulls the metrics from the audit log, switches between detection and blocking, and tunes the rules, always validating the configuration before reloading and rolling back if something fails.
Migration from TheHive
Coming from TheHive? Bring your cases into Gjallarhorn in one step. The import is idempotent (it de-duplicates by the source identifier), maps severity, status and TLP, pulls the observables, and turns off the integration when done. If something is off, it undoes without touching your own cases.
This is not a prototype. This is Gjallarhorn at work.
Twenty-seven seconds of an actual walkthrough: the SOC executive report, an indicator checked against ten intelligence sources, a Cobalt Strike beacon found inside a spreadsheet, a sample detonated in the sandbox, and the forensics of a phishing email.
Click here and request a live demo with our team. We walk you through the whole platform, module by module, with your own scenario on the table, answering anything you want to ask.
The sandbox runs on self-hosted CAPE and returns observed behaviour, network connections, processes, and dropped files. Because it is ours, the sample never leaves the organisation, which is exactly what rules out a public service when the file belongs to a client.
Every indicator is queried in parallel against VirusTotal, AlienVault OTX, ThreatFox, MalwareBazaar, URLhaus, AbuseIPDB, Shodan, Criminal IP, IPQualityScore, and URLScan. The panel shows what each one answered and at what detection rate, so the analyst can see what the score rests on.
SPF, DKIM and DMARC, the header chain, business email compromise detection, and the indicators pulled from the body. Most incidents come in this way, and a clean link inside a poorly authenticated message is still a problem.
Every result carries the button that opens the case, with the evidence that triggered it already inside. That is the step where half the work gets lost when the investigation lives in one tab and case management in another.
Wazuh, Suricata, OpenVAS, Nessus, Velociraptor, TheHive and Shuffle connect and report their status in the same panel. It does not replace your defensive stack, it adds the layer it was missing so the analyst stops jumping between consoles.
Gjallarhorn grows with every real investigation
It’s not a finished platform, it’s a living system that incorporates new capabilities as AllSafe’s analysts need them in production.
v1.0, SOC core
The base platform, with the integrations and the analysis that carry day-to-day operations.
v1.2, sandbox and detection rules
Dynamic analysis of unknown malware, and the detection rule generated from the case itself.
v1.3, automatic response and reporting
The circuit moves from detecting to acting, and reports are generated on their own.
v1.4, several organizations in one installation
Full data isolation per organization, on the same instance.
v1.5, asset inventory and infrastructure monitoring
Knowing which devices exist and whether they are up, without waiting for someone to tell you.
v1.6, migration from third-party platforms
Bring the cases from an existing TheHive without starting from scratch.
v1.8, WAF management
Manage the server’s application firewall from the SOC, without logging in over SSH.
v1.9, advanced automatic response
Multi-step responses, configurable without writing code.
v2.0, orchestration with the offensive team
Optional bridge with Gungnir to align defense and pentest.
v3.0, AI on-site and in the cloud
Language model integration to automate platform processes, with the model running inside your own infrastructure or in the cloud, as you choose.
Not another layer on top of your tools. The layer that was missing.
Built by security analysts who got tired of losing time between tools that don’t talk to each other.
Integration, not replacement
Connects with TheHive, Wazuh, Velociraptor, and Nessus via API. It doesn’t replace your tools, it makes them work together for the first time.
Designed for real SOCs
Every feature exists because an AllSafe analyst needed it in a real investigation. No empty demos, no catalog features.
RBAC + 2FA from day one
JWT with TOTP two-factor authentication, role-based access control, and rate limiting. The security of the security tool is not optional.
Support from those who built it
You’re not buying a license and being left alone. The AllSafe team that developed Gjallarhorn supports you through implementation, configuration, and integration.
I want Gjallarhorn in my SOC
Fill out the form and an AllSafe specialist will contact you to evaluate your environment, demonstrate the platform in action, and design the implementation for your team.
Sabías que existe Gjallarhorn Community?
Versión gratuita y open source (AGPL-3.0) con los módulos centrales de la plataforma: investigación IOC, análisis de malware, forense de email, gestión de casos e integraciones SOC. Libre para siempre, código auditable, listo para desplegar.