Skip to main content
Calseta is under active development. APIs and features may change. We welcome feedback and contributions on GitHub.

​
Run Calseta locally

That’s it. The platform starts three services:

​
Try the lab

The lab is a fully seeded demo environment with sample alerts, enrichment data, and a full-access API key. It’s the fastest way to explore Calseta’s capabilities:
This seeds 5 alerts with enriched indicators, detection rules with full documentation, context documents, and workflows. A pre-configured API key is printed at the end:
Use make lab-reset to wipe and re-seed from scratch. Use make lab-stop to stop all services.

​
Create an API key

For non-lab usage, create your own API key:
Save the returned key immediately — it cannot be retrieved after creation.

​
Open the UI

Once services are running, open http://localhost:5173 in your browser. The dashboard gives you a visual interface for managing alerts, configuring detection rules, enrichment providers, workflows, and more.
Calseta UI — Alert list view
The UI is optional — everything it does is also available via the REST API and MCP server. Use whichever interface fits your workflow.

​
Next steps

How It Works

Understand the five-step pipeline: ingest, normalize, enrich, contextualize, and dispatch.

Authentication

Create API keys and authenticate your requests.

Alert Sources

Connect Microsoft Sentinel, Elastic, Splunk, or a generic webhook.

UI Dashboard

Explore the web dashboard for alert management and settings.

MCP Setup

Connect your AI agent to Calseta via the MCP server.