Getting Started with Bhairava
Bhairava is an AI-agent-driven Security & Network Operations platform. It ingests telemetry from your endpoints and tools, and lets autonomous agents triage, investigate, hunt, and remediate — with humans in the loop only where it matters.
Overview
A traditional SOC drowns analysts in alerts. Bhairava flips the model: a streaming pipeline normalizes every event, and three tiers of AI agents do the first (and often the final) pass of work — classification, correlation, investigation, containment, hunting, detection engineering, forensics, and compliance — using the same tools your analysts would.
It runs as a self-hosted stack (Docker Compose or Kubernetes) with a React dashboard, a FastAPI backend, a Kafka event backbone, and Wazuh as the SIEM/EDR data source. Everything is multi-tenant, so MSSPs can run many clients on one deployment.
Architecture →
How the pipeline, agents, and data plane fit together.
Install →
Stand up the manager in one command, then enroll agents.
Features →
Every module, from alert triage to compliance.
Book a demo →
See Bhairava on your own data with our team.
Key concepts
A few terms recur throughout the docs. Understanding these makes everything else click.
| Concept | What it means |
|---|---|
| Agent tiers | Three levels of autonomy: L1 triages alerts, L2 investigates incidents, and Executors run hunt / detection / forensics / compliance pipelines. |
| Endpoint agent | A lightweight collector installed on hosts (Linux/Windows/macOS/Docker) that streams security telemetry back to the manager. |
| MCP server | A Model Context Protocol tool server that exposes an integration's capabilities to the AI agents. Bhairava ships 15. |
| Integration | A connector to an external tool (SIEM, EDR, threat intel, cloud, ticketing…). 76 are built in. |
| Pipeline | The Kafka-based ingestion spine: collect → normalize → dedup → enrich → index → hand off to L1. |
| HITL | Human-in-the-loop — approval gates where a person confirms a high-impact action before an agent takes it. |
| Tenant | An isolated customer/organization boundary. One deployment serves many tenants (MSSP mode). |
Quick start
Stand up a full Bhairava manager on a fresh Linux server with a single command — it installs Docker, generates all secrets, provisions TLS, starts every service, and creates your admin user.
1. Install the manager
# Ubuntu 20.04+ / Debian 11+ / RHEL 8+ · 4 CPU · 8 GB RAM · 50 GB disk
curl -fsSL https://raw.githubusercontent.com/bhairava-soc/bhairava/main/deploy/scripts/install.sh \
| sudo bash -s -- --domain soc.example.comThe installer prints your dashboard URL and login credentials when it finishes. See the Installation guide for Docker Compose, Kubernetes, Ansible, and air-gap options.
2. Log in
Open https://soc.example.com, accept the self-signed certificate warning, and sign in as admin. Change your password from Profile → Change Password.
3. Deploy an endpoint agent
Generate an enrollment token in the dashboard (Agent Fleet → Deploy Agent), then run the one-liner on any host:
# Linux (systemd)
curl -k -sSL https://soc.example.com/api/agents/managed/setup/install.sh \
| sudo bash -s -- --token <ENROLLMENT_TOKEN>The agent enrolls automatically and appears in Agent Fleet within ~30 seconds. Windows, macOS, and Docker installers follow the same pattern — see Agent installation.
4. Watch it work
As telemetry arrives, L1 agents begin triaging alerts on the Alerts page, and incidents form automatically. Book a demo to see the flow on your own data.