Calseta is an open‑source, self‑hosted platform that ingests raw security alerts, normalizes them to a consistent schema, and enriches each indicator with threat intel, identity data, and internal organizational context. By delivering a single, context‑rich webhook payload, it eliminates the need for custom integration code and reduces token waste, allowing security analysts and AI agents to focus on investigation and response.
Funding
Funding not disclosed
Founders
Product
Problem
Security analysts spend most of their engineering effort on stitching together multiple tools—SIEMs, threat intel services, identity platforms, and ticketing systems—rather than analyzing alerts. This results in missing organizational context, excessive API calls, and large, noisy data payloads that consume LLM token limits and slow down response.
Solution
Calseta provides a self‑hosted, open‑source platform that ingests raw security alerts, normalizes them to a consistent, agent‑friendly schema, and enriches every indicator with threat intel, identity data, and internal context in parallel. The enriched payload includes matched runbooks, detection rule documentation, past alert history, and available automation workflows, all delivered via a single webhook to downstream agents. By handling deterministic enrichment, normalization, and context attachment, Calseta eliminates the need for custom integration code and reduces token waste, allowing security agents to focus on reasoning and response.
Target Audience
Primary users are security operations centers and SOC teams that deploy AI or LLM‑based investigation agents, as well as developers building custom security automation workflows.
Features
- Plugin‑based alert ingestion supporting Elastic, Sentinel, Splunk, and generic webhooks; extensible via a single Python class
- Parallel, cached enrichment engine that queries multiple threat intel and identity providers (e.g., VirusTotal, AbuseIPDB, Okta) per indicator
- Unified, AI‑optimized schema that normalizes fields across sources and presents enrichment results first
- Automatic attachment of organization‑specific context documents such as runbooks, IR plans, and past alerts based on targeting rules
- Built‑in detection rule library with MITRE ATT&CK mapping and markdown documentation surfaced in every alert
- Executable HTTP automation workflows with sandboxed AST validation, versioning, test mode, and optional human‑in‑the‑loop approval gates
- Model Context Protocol (MCP) server enabling any MCP‑compatible agent to query alerts, docs, and trigger workflows without custom client code
- Metrics API exposing SOC KPIs (alert volume, false positive rate, MTTD) in a machine‑readable format