Wazuh

关于

Wazuh bridges the gap between the Wazuh SIEM and applications needing contextual security data, particularly those using the Model Context Protocol (MCP). This server, written in Rust, allows AI assistants and other tools to leverage real-time security alerts and events from Wazuh, enabling use cases like automated alert triage, enhanced alert correlation, dynamic security visualizations, multilingual security operations, and natural language data interaction. It facilitates a streamlined connection between Wazuh's API and MCP-compatible clients, allowing for enhanced security operations and AI-driven analysis.

主要功能

• Translates Wazuh data into the Model Context Protocol (MCP) format.
• Enables communication between Wazuh and LLM clients like Claude Desktop.
• Supports stdio and optional HTTP communication.
• Configurable through environment variables for Wazuh API and server settings.
• 2 GitHub stars

使用案例

• Query Wazuh data using natural language for intuitive access to security information.
• Automate alert categorization and prioritization via AI.
• Enrich alerts by correlating with CVEs, OSINT, and other threat intelligence.