Happy slice of mcp pizzaMCP.pizza

mcp-server-wazuh

MCP.Pizza Chef: gbrigandi

Security teams running Wazuh can ask plain questions instead of writing queries: which alerts fired overnight, which machines have critical unpatched flaws, what is running on a particular machine, or whether logging meets a compliance rule. Answers come straight from your own Wazuh installation, covering alerts, monitored machines, detection rules, cluster health, and manager logs. You need a running Wazuh server, version 4.12 or later, that this can reach, and it is usually installed from a ready-made container image.

Data
Other

Use This MCP server To

Review the security alerts that fired overnight Find critical unpatched flaws on my web servers Check which processes are running on a specific machine See which monitored machines have gone offline Ask whether our logging meets a compliance requirement Search the manager logs while investigating an incident

README

Wazuh MCP Server - Talk to your SIEM

A Rust-based server designed to bridge the gap between a Wazuh Security Information and Event Management (SIEM) system and applications requiring contextual security data, specifically tailored for the Claude Desktop Integration using the Model Context Protocol (MCP).

Overview

Modern AI assistants like Claude can benefit significantly from real-time context about the user's security environment. The Wazuh MCP Server bridges this gap by providing comprehensive access to Wazuh SIEM data through natural language interactions.

This server transforms complex Wazuh API responses into MCP-compatible format, enabling AI assistants to access:

  • Security Alerts & Events from the Wazuh Indexer for threat detection and incident response
  • Agent Management & Monitoring including health status, system processes, and network ports
  • Vulnerability Assessment data for risk management and patch prioritization
  • Security Rules & Configuration for detection optimization and compliance validation
  • System Statistics & Performance metrics for operational monitoring and audit trails
  • Log Analysis & Forensics capabilities for incident investigation and compliance reporting
  • Cluster Health & Management for infrastructure reliability and availability requirements
  • Compliance Monitoring & Gap Analysis for regulatory frameworks like PCI-DSS, HIPAA, SOX, and GDPR

Rather than requiring manual API calls or complex queries, security teams can now ask natural language questions like "Show me critical vulnerabilities on web servers," "What processes are running on agent 001?" or "Are we meeting PCI-DSS logging requirements?" and receive structured, actionable data from their Wazuh deployment.

This approach is particularly valuable for compliance teams who need to quickly assess security posture, identify gaps in monitoring coverage, validate rule effectiveness, and generate evidence for audit requirements across distributed infrastructure.

Example Use Cases

The Wazuh MCP Server provides direct access to Wazuh security data through natural language interactions, enabling several practical use cases:

Security Alert Analysis

  • Alert Triage and Investigation: Query recent security alerts with get_wazuh_alert_summary to quickly identify and prioritize threats requiring immediate attention.
  • Alert Pattern Recognition: Analyze alert trends and patterns to identify recurring security issues or potential attack campaigns.

Vulnerability Management

mcp-server-wazuh FAQ

Which apps does it work in?
It is built and tested for Claude Desktop, and other assistants that support MCP can connect as well.
What do I need before installing it?
A running Wazuh server, version 4.12 or later, that this add-on can reach over your network.
Do I need a key?
No separate key — it signs in using the credentials for your own Wazuh installation.
Can I use this to triage this morning's alerts?
Yes — ask for a summary of recent alerts, then drill into the ones worth chasing.
How hard is the setup?
Developer level: run the container image and give it the address and credentials for your Wazuh server.
Where does my security data go?
It reads from your own Wazuh installation, so only the answers you ask for are passed to your assistant.