Wazuh bridges the gap between the Wazuh SIEM and applications needing contextual security data, particularly those using the Model Context Protocol (MCP). This server, written in Rust, allows AI assistants and other tools to leverage real-time security alerts and events from Wazuh, enabling use cases like automated alert triage, enhanced alert correlation, dynamic security visualizations, multilingual security operations, and natural language data interaction. It facilitates a streamlined connection between Wazuh's API and MCP-compatible clients, allowing for enhanced security operations and AI-driven analysis.
Key Features
01Translates Wazuh data into the Model Context Protocol (MCP) format.
02Enables communication between Wazuh and LLM clients like Claude Desktop.
03Supports stdio and optional HTTP communication.
04Configurable through environment variables for Wazuh API and server settings.
052 GitHub stars
Use Cases
01Query Wazuh data using natural language for intuitive access to security information.
02Automate alert categorization and prioritization via AI.
03Enrich alerts by correlating with CVEs, OSINT, and other threat intelligence.
