Wazuh
Connects the Wazuh SIEM to applications needing contextual security data via the Model Context Protocol (MCP).
About
Wazuh bridges the gap between the Wazuh SIEM and applications needing contextual security data, particularly those using the Model Context Protocol (MCP). This server, written in Rust, allows AI assistants and other tools to leverage real-time security alerts and events from Wazuh, enabling use cases like automated alert triage, enhanced alert correlation, dynamic security visualizations, multilingual security operations, and natural language data interaction. It facilitates a streamlined connection between Wazuh's API and MCP-compatible clients, allowing for enhanced security operations and AI-driven analysis.
Key Features
- Translates Wazuh data into the Model Context Protocol (MCP) format.
- Enables communication between Wazuh and LLM clients like Claude Desktop.
- Supports stdio and optional HTTP communication.
- Configurable through environment variables for Wazuh API and server settings.
- 2 GitHub stars
Use Cases
- Query Wazuh data using natural language for intuitive access to security information.
- Automate alert categorization and prioritization via AI.
- Enrich alerts by correlating with CVEs, OSINT, and other threat intelligence.
Sponsored