Disconnected operations
Air-gapped SIEM with on-box AI
Most security platforms can be installed without internet access. Far fewer keep working well once they are, and the difference only shows up months later, in the parts nobody demonstrated.
Here is what works in ours, what degrades, and the questions worth putting to any vendor — us included — before you commit.
“Can it install offline” is the wrong question
Almost anything can be installed without a network if you try hard enough. The question that decides whether a disconnected SOC actually functions is what happens on day ninety: whether the console still loads without reaching for a font, whether a CVE lookup during an investigation returns anything, whether the reports still generate, and whether the AI feature you were sold has anywhere to run.
That last one has become the sharpest divide. A great deal of security AI is hosted by the vendor, which means in a classified enclave it is not a degraded feature — it is an absent one. The choice is not between a better assistant and a worse one. It is between one and none.
What works with no connectivity at all
The supply chain is vendored in-tree
No external CDN calls, and fonts and map tiles are self-hosted. A browser opening the console inside a disconnected network is not reaching out for assets that will never arrive.
Container images install without registry access
wfa images --save and wfa images --load move images in and out on media, so bringing up or updating an appliance does not require a route to a container registry.
CVE detail is served from locally imported data
Vulnerability detail comes from an imported NVD dataset held on the appliance, with no runtime fetch. Looking up a CVE mid-investigation does not depend on egress.
The AI assistant can run entirely locally
Served through Ollama on your own hardware, the question, the tool calls, the evidence and the answer all stay inside the network. This is the part most platforms cannot do at all: a hosted assistant has nowhere to run in a disconnected enclave.
Scheduled reports render offline
PDF generation does not reach outside the appliance, so compliance and executive reporting keeps working on a schedule with no connectivity.
Blocking egress is a supported state, not a failure
Blocking intel.witfoo.com switches off diagnostics and threat-intelligence lookups together, and the platform keeps running with reduced enrichment. Licence verification uses a separate service.
What leaves the network in a connected deployment
Worth stating precisely rather than waving at, because “we don't phone home” is a claim that falls apart the first time someone runs a packet capture.
Connected, WitFoo sends operational metrics, operational logs, parsing failures, automatic problem reports and threat-intelligence lookups to us, and verifies your licence against a separate service. All of it is authenticated with your licence key. Support packs and indicator sharing are off unless you turn them on.
The off switch is your own network policy. Block that egress and those functions stop together, and the platform keeps running with reduced enrichment. It is a supported state rather than a broken one — which is the property that actually matters, because a system that merely tolerates disconnection tends to fail in ways you find out about later.
Six questions to ask before you buy
These are the procedures that decide whether a disconnected deployment is pleasant or miserable to run, and they are the ones least likely to come up in a demo. Ask them of every vendor on your list.
We are including ourselves in that. Our answers to these are not yet in our public documentation — we have raised that internally — so for now, ask us directly and we will tell you.
-
How does threat intelligence refresh without egress?
Enrichment degrades over time if indicators never update. Ask what the supported import path is, what the artefact looks like, and what cadence is expected.
-
How are software and appliance updates delivered, and how are they verified?
Media, cadence and the signing chain. In a classified enclave the verification story matters as much as the delivery one, because you are trusting something that arrived on a disk.
-
What happens to licensing when the licence service is unreachable?
This is the sharpest question on the list. Licence verification runs against a separate service with egress on by default, and its offline behaviour is not documented. Ask specifically what happens at renewal inside an air gap — it is a contractual question as much as a technical one.
-
How are time synchronisation and certificate validation handled?
Sequence is how intent is established, so clock discipline matters more here than almost anywhere. Certificate and CRL validation also need an answer when nothing can reach an OCSP responder.
-
How does a local model get installed and updated?
Running the assistant locally is a genuine differentiator, but the model has to get in somehow, and be updated later. Ask what the supported path is rather than assuming it mirrors the container-image flow.
-
How do support bundles leave a classified enclave?
When you need help, something has to cross the boundary. Ask what can be extracted, in what form, and what the sanitisation story is before you need it at three in the morning.
What this page does not claim
-
That WitFoo is the only SIEM that can run air-gapped. It is not, and it would be easy to check — self-managed Splunk Enterprise supports air-gapped and classified deployment, and several pipeline products can be deployed disconnected. The narrower claim is about doing the pipeline, the SIEM, the compliance reporting and a working AI assistant all disconnected at once, rather than air-gapping one layer and reaching outside for the others.
-
That WitFoo holds any government authorization. It holds no FedRAMP or DoD Impact Level authorization. It deploys inside your authorization boundary, and Reporter reports against the FedRAMP moderate baseline controls.
-
That nothing leaves the network in a connected deployment. Several things do, by default. They are listed above, and blocking them is your decision to make at the network.
-
That the six questions above have published answers today. They do not, which is why they are questions here rather than procedures. Ask us.
Questions people actually ask
Can WitFoo run in a fully air-gapped network?
Yes, and it is deployed in air-gapped and classified environments. The parts that usually break in a disconnected network are handled: the supply chain is vendored in-tree with no external CDN calls, container images install from media without registry access, CVE detail is served from locally imported data with no runtime fetch, scheduled reports render offline, and the AI assistant can run entirely on local hardware through Ollama. Several operational procedures — intelligence refresh, update delivery, offline licensing — are not yet documented publicly, and are worth confirming with us for your specific environment.
Does WitFoo phone home?
In a connected deployment, yes, by default, and it is worth being precise about what that means. Operational metrics, operational logs, parsing failures, automatic problem reports and threat-intelligence lookups go to intel.witfoo.com, and licence verification goes to a separate service. All of it is authenticated with your licence key. Support packs and indicator sharing are off by default. The complete off switch is your own network policy: block the egress and those functions stop, while the platform keeps running with reduced enrichment.
Can the AI assistant work without internet access?
Yes, if you run a local model. Served through Ollama on your own hardware, the question, the tool calls, the evidence and the answer never leave the network. That is the difference that matters in a disconnected or classified environment — a hosted assistant has nowhere to run at all, so the choice is not between a better and a worse assistant but between one and none.
Does WitFoo hold a FedRAMP or Impact Level authorization?
No. WitFoo holds no FedRAMP or DoD Impact Level authorization. It deploys on infrastructure the customer controls, including fully air-gapped enclaves, where the customer’s own authorization boundary applies. Reporter reports against the FedRAMP moderate baseline controls. Anyone telling you WitFoo is FedRAMP authorized is mistaken.
Is WitFoo the only SIEM that can run air-gapped?
No, and it would be easy to check. Self-managed Splunk Enterprise supports air-gapped and classified deployment, and several pipeline and SIEM products can be deployed disconnected. The narrower thing that is true is about doing all of it at once: running the pipeline, the SIEM and the compliance reporting fully air-gapped, with a working AI assistant, rather than air-gapping one layer and reaching outside for the others.
What degrades when you disconnect?
Enrichment, honestly. Threat-intelligence lookups stop, so indicators are only as current as your last import, and automatic problem reports stop reaching us, which means we find out about your problems when you tell us. Detection, correlation, investigation, response and reporting all continue. The degradation is real and bounded, and it is better to know its shape in advance than to discover it during an incident.
The assistant runs where the data is.
WitFoo deploys on infrastructure you control — a cloud tenancy, a data centre, an office with no data centre, or a network that never touches the internet. Licensed flat per appliance, with unlimited data rates.