Ardea Install free

Alert triage for Elastic Security

Every alert weighed.
Every verdict explained.

Ardea is a Tier‑1 analyst that runs on your own hardware. It investigates each Elastic Security alert with read‑only queries and a local LLM, closes the routine ones with evidence, and hands anything uncertain to a person.

Install free Try the 2-minute demo
Free for one cluster, no card needed No alert data leaves your network Source code you can read
The Ardea console: verdict counts at the top, filters, and an expanded True Positive alert with its summary, cited findings, two explanations and recommended actions.

The Ardea console, shown with example alerts.

Works withElastic SecurityElastic Defend or SysmonOllamaDocker Compose

The problem

Proving an alert is harmless takes as long as catching an attack.

Routine work crowds out real work

Backup scripts, installers and admin tools trip the same rules every day. Each one still needs someone to open the process tree and check the history.

Nights and weekends get thin

Alerts that arrive at 3 a.m. wait for the morning, or get a rushed look from whoever is on call.

Cloud AI means your logs leave

Most AI triage tools send command lines, hostnames and user names to someone else's servers. Many teams can't allow that.

How it works

The same careful routine, for every alert

Three small containers and Postgres on one Docker host, next to your Elastic cluster and an Ollama server.

  1. Collect

    Every few minutes Ardea picks up new open alerts, skips the rules you ignore, and folds duplicates into one alert with a count.

  2. Investigate

    A playbook for the rule runs fixed queries first: process tree, 30-day history, related alerts. The model can ask for up to ten more, all read-only.

  3. Decide

    The model writes a verdict that cites its evidence. Before anything is closed, a sceptical second pass looks for facts the harmless story can't explain.

  4. Publish

    Your team sees the verdict, the evidence and every query. Their thumbs-up or correction is shown to the model on similar alerts later.

Transparency

Ardea shows its work.

You never have to take a verdict on faith. Each one comes with the reasoning and the queries behind it, so checking a closed alert takes seconds.

  • Every claim cites evidence. Findings that point to evidence that doesn't exist are removed before you see them.
  • Both sides are argued. Each verdict states the best malicious and the best harmless explanation.
  • Every step is recorded. Each query, its arguments, its result and every model turn are in the investigation trail.
example · fs01Defense Evasion
BENIGN POSITIVEINFORMATIONALCONFIDENCE 88

Command Execution via ForFiles

fs01 · svc.backup · forfiles -p "C:\SQL Backups\Automatic" -s -m *.* /D -3 /C "cmd /c del @path"

  • E2Same command line on 30 of the last 30 days, only on fs01, only as svc.backup
  • E1Started by Task Scheduler → cmd → RunBackup.bat in C:\Acme\Scripts\Backup SQL
  • E3No other alerts on fs01 in the 48 hours before
enrichment get_process_tree → E1
enrichment get_baseline process.command_line 30d → E2
enrichment get_related_alerts host 48h → E3
review     closure upheld, no unexplained facts
guardrails none changed the verdict
The Ardea Insights report: alerts triaged, share closed automatically, alerts sent to a person, true positives, analyst time saved and analyst agreement, followed by the list of true positives.

For managers · Pro

Prove the value every month.

A one-page report from your own alerts: what was triaged, what was closed with evidence, what reached a person, and the analyst time it saved. Print it, save it as PDF, or have it e-mailed every week or month.

  • Rule-tuning advisor. Finds the patterns that are always harmless and writes the Elastic exception for each, ready to paste. Fewer alerts before triage even starts.
  • Trends. Verdicts, analyst agreement and time per alert, week by week.
  • Fits your tools. True positives go to Slack, Teams, Jira, TheHive, a webhook or e-mail.

Safety

What Ardea will never do

These rules run in code after the model has answered. The model can't talk its way past them, and they are the same in the free edition.

Send your alerts to a cloud AI

The model runs in your Ollama. Web search is off by default, and when on, only public indicators like an IP or a hash pass a filter, and every query is logged.

Change a host or your SIEM

It uses two Elastic API keys that can only read, and fixed query templates with time limits. There is no code in Ardea that takes action.

Close a high-impact alert alone

Credential access and lateral movement always go to a person. So does anything similar to an alert your analysts marked malicious.

Close on a hunch

A closing verdict below 70% confidence, or one without cited evidence, goes to a person instead.

Follow instructions hidden in data

Command lines and file names are treated as untrusted. Text that tries to steer the model blocks automatic closure instead.

Drop an alert

A crash or an Ollama outage puts the alert back in the queue. After three failures it appears as Needs Human Review, with the reason.

Try it now

See it on your own screen in two minutes

The demo runs the Ardea console on your computer with eight weeks of sample alerts. No Elastic cluster, no Ollama, no sign-up.

  1. Run three commands on any machine with Docker.
  2. Open https://localhost:8443 and accept the browser warning (the certificate is made on your computer).
  3. Sign in as demo / demo and open an alert, its trail and the Insights report.

Sample data only, with every paid feature switched on. It is reachable from your computer only, and one command removes it when you're done.

Terminal
$ git clone https://github.com/GikaBites/ardea.git
$ cd ardea
$ docker compose -f docker-compose.demo.yml up -d --build
✓ Demo ready at https://localhost:8443 · demo / demo

Pricing

Start free. Upgrade when it earns its place.

Every edition triages the same way, with the same safety rules. Paid editions add the features that save your team time.

Community

To try Ardea, or run it on one cluster

€0

Free for as long as you use it

  • Full investigation and every guardrail
  • Web console with roles, audit trail and feedback
  • Optional web search with the outbound filter
  • One Elastic cluster
Download free
Recommended for SOC teams

Pro

For in-house security teams

€49/ month

or €490 a year: save €98

  • Monthly management report: print, PDF or e-mailed
  • Rule-tuning advisor with ready-to-paste Elastic exceptions
  • Alerts to Slack, Teams, Jira, TheHive, webhook and e-mail
  • Playbook pack: expert guidance for 30 noisy Elastic rules, updated monthly
  • Weekly trends and analyst agreement
  • Single sign-on, re-triage, CSV export
  • Email support
Get Pro

MSP

For providers serving many customers

€199/ month

Per installation, any number of customers

  • Everything in Pro
  • One Elastic cluster per customer, in one console
  • A monthly report for each customer, under your brand
  • Each customer's alerts to their own e-mail, Slack or Teams
  • Customer portal: read-only logins per customer
  • Per-customer facts and playbooks
  • Usage export for billing, and the right to run Ardea as a managed service
  • Your own name and logo in the console
Get MSP
Cancel any time Full refund within 14 days Triage never stops if a licence lapses

Prices exclude VAT. Payment, invoices and VAT are handled by our reseller, Lemon Squeezy.

Questions

Before you install

Something else on your mind? Ask before you buy; the answer is usually in the docs, and we'll point you to it.

Does any alert data leave my network?

No. The model runs in your own Ollama, and Ardea talks only to your Elastic cluster and its database. Web search is off unless you turn it on. The paid licence check sends only the licence key and an installation name, once a day.

Does it replace my analysts?

No. It takes the first look at every alert, closes clearly routine ones with evidence, and sends everything uncertain or high-impact to a person. We recommend reviewing a sample of closed alerts every week; the trail shows exactly why each one was closed.

What hardware do I need?

A Linux Docker host with 2 cores and 4 GB of RAM for Ardea itself, plus an Ollama server. Without a GPU, a 30B mixture-of-experts model takes about three minutes per alert on two Xeon Gold 6126 CPUs; a 12–16 GB GPU is much faster.

What happens if my licence expires or your server is down?

Triage keeps running. If the licence server can't be reached, paid features stay on for 30 days. If a subscription ends, they stay on for 72 hours, then Ardea switches to the free edition. No safety rule, user restriction or queued alert is affected.

Can I run it for my customers?

Yes, with the MSP edition. Its licence explicitly allows running Ardea as a managed service. It collects from one Elastic cluster per customer and limits each analyst to the customers they may see.

Can I try it before connecting it to my SIEM?

Yes. The demo runs the console on your computer with sample alerts, no Elastic or Ollama needed. When you're ready, the free edition connects to one Elastic cluster.

Our servers have no internet access.

Ask for an offline licence file. It is signed, checked locally, and needs no connection.

Let tonight's alerts get a careful first look.

Install the free edition in an afternoon. Keep it if it earns its place; upgrade when your team wants the time savers.

Install free Try the demo