An open-source SIEM, port detection rules and AI agents that triage alerts and draft NIS2 notices. You decide.
Segments covered
NIS2 early warning
NIS2 notification
To go live
Why ports need continuous detection
Ports have become a target, the law now requires fast detection and notification (see what NIS2 asks of ports), and most sites have neither the team nor the budget of a security operations centre.
Ports are targeted
Nobody reads the logs
The 24-hour countdown
Fragile OT
One SIEM, three sizes: from marina to terminal
The same open-source platform and the same port rules, sized for each site. Each customer has its own SIEM and its own keys. The Wazuh rules and decoders we write are listed with our open-source packages.
Marinas, warehouses, carriers
Up to 10 workstations and servers
Escale
Port SIEM offer
Terminals and ports
Up to 50 workstations and servers
Quai
Port SIEM offer
Essential operators, multi-site
Beyond 50 machines, OT sensors
Vigie
Port SIEM offer
Two kinds of agents, one clear rule
A Wazuh agent on every machine
AI triage agent
AI investigator
NIS2 drafter
Compliance auditor
The human decides
Why Wazuh: our comparison of open-source SIEMs
Open-source SIEMs compared
Scoring criteria
Winner's score
Finalists assessed in detail
Container terminals: TOS, gate, OCR, carrier portal and truck appointments are monitored by rules written by a team that builds terminal software.
— Terminals · 20 to 200 machines
Port authorities and logistics: port community systems, harbour master's office, EDI with carriers and customs, shared accounts and supplier access.
— Authorities and logistics · 5 to 500 machines
Marinas: harbour office software, online payment and boaters' Wi-Fi, for sites without an IT person.
— Marinas · 3 to 15 machines
Live in 90 days
From scoping to a timed incident exercise, in four steps.
1. Scoping
2. Deployment
3. Tuning
4. Proof
Port SIEM FAQ
Questions about a SIEM for your marina, your terminal or your port authority? We are here to help.
Yes. The Wazuh agent and manager are under GPLv2, the indexer under Apache 2.0, the rules engine under AGPLv3. You run it in your own name, in a European cloud or on your own site.
No. They read the SIEM through a read-only API, then triage, link and draft. Every blocking action is proposed to a human, never executed alone.
Never. OT is monitored by a passive network sensor on a mirror port. It listens and sends nothing. No agent is installed on any automation.
In your own SIEM, with your own keys: a dedicated instance in a European cloud, your site behind your VPN, or a mix of both. Your logs never mix with another customer's.
Yes. A marina often has open Wi-Fi, online payments and no IT person. The Escale offer brings a few agents, the baseline rules and a monthly report the harbour master can read.
It detects, keeps the incident timeline and drafts the 24-hour, 72-hour and one-month reports. It helps prove the Article 21 measures; it replaces neither your security policy nor your risk analysis.
Protect your port before the next incident
Start with a 30-minute scoping call: your machines, your suppliers, your NIS2 obligations and the offer that fits your site. Want a first reading on your own? Take the 2-minute engineer self-assessment.