广告合作
MCP.so
登录

Wazuh MCP Server

@gbrigandi

代码仓库

基本信息

分类

其他

许可证

MIT

传输方式

stdio

作者

gbrigandi

关于 Wazuh MCP Server

MCP Server for Wazuh SIEM

#mcp#siem#wazuh#security-operations#llm#wazuh-integration#mcp-server#model-context-protocol-servers#model-context-pro

Wazuh MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "mcp-server-wazuh": {
      "command": "docker",
      "args": [
        "pull",
        "ghcr.io/gbrigandi/mcp-server-wazuh:latest"
      ]
    }
  }
}

Wazuh MCP Server 工具

工具列表暂未提供

当前收录暂时没有可展示的工具列表，不代表服务没有工具。请查阅项目文档了解支持的能力。

工具是从 README 中自动提取的。维护者可以在 ## Tools 标题下列出工具,即可填充这部分内容。

概览

What is Wazuh MCP Server?

A Rust-based server that bridges Wazuh SIEM data with MCP-compatible AI assistants like Claude Desktop. It transforms complex Wazuh API responses into structured security context, enabling natural language queries for alerts, agents, vulnerabilities, rules, and compliance data.

How to use Wazuh MCP Server?

Install via pre-built binary, Docker image, or build from source with Rust. Configure environment variables for Wazuh API and Indexer credentials, then point your MCP client (e.g., Claude Desktop) to the server executable or Docker container.

Key features of Wazuh MCP Server

  • Real-time access to security alerts and events
  • Agent management and health status monitoring
  • Vulnerability assessment for risk management
  • Security rules and configuration access
  • System statistics and performance metrics
  • Compliance monitoring for PCI-DSS, HIPAA, etc.

Use cases of Wazuh MCP Server

  • Triage and prioritize security alerts using natural language queries
  • Assess agent vulnerabilities and prioritize patching efforts
  • Investigate running processes and open ports for threat hunting
  • Monitor cluster health and manager performance metrics
  • Automate compliance reporting and gap analysis for audits

常见问题

1

What are the requirements for running the server?

A running Wazuh server (v4.12 recommended) with API enabled, network connectivity, and an MCP-compatible LLM client like Claude Desktop.

2

How do I install and configure the server?

You can download a pre-built binary, pull a Docker image, or build from source with Rust. Configuration is done through environment variables for Wazuh API/Indexer host, port, and credentials.

3

Can I use this server with other MCP security tools?

Yes, it can be combined with Cortex MCP Server, TheHive MCP Server, and MISP MCP Server for enhanced threat intelligence, case management, and IOC enrichment.

4

What data sources does the server access?

It accesses data from both the Wazuh Indexer (alerts) and the Wazuh Manager (agents, rules, vulnerabilities, cluster health, logs, and statistics).

评论

其他 分类下的更多 MCP 服务器

Handl

Handl speaks the Model Context Protocol. Your whole billing operation — projects, invoices, clients, reports, approvals — as tools any AI assistant can call, inside your autonomy rules.

DeepMark

DeepMark helps teachers deliver rapid, consistent marking with meaningful feedback for every student — in a fraction of the time. What once took a week, now takes one free period.

MaxKB

1Panel-dev

🔥 MaxKB is an open-source platform for building enterprise-grade agents. 强大易用的开源企业级智能体平台。

22.0K

der die das – German noun genders (Lingviko)

Lingviko

The article (der, die, das) of 90,000 German nouns, compounds included, plus a checker that finds wrong articles in German text (“mit der Zug” → dem). Uses dictionary data, not AI guessing. Free, no login.

Health by Dr Brad

Dr Brad Stanfield

Health by Dr Brad works out a health plan from your own results: which screening is due at your age, and evidence-based suggestions, each with the reason and the published guideline or study behind it. Your record is one

广告合作