# Wazuh SIEM MCP for AI Agents AI Agent Connect

> Wazuh (SIEM) MCP connects your AI client to your security infrastructure. Monitor agents, query security events like File Integrity Monitoring, and manage manager configurations using natural language. It turns your agent into a direct command line for your SIEM.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_REUf3LN8uLwAvmnqLRFwWwNJqnVgVW6WS1Ew5q4A/ai-agent-connect
- **Tags:** siem, threat-detection, vulnerability-management, endpoint-security, incident-response

## Description

Security operations usually feel like a game of hide and seek. You spend your day jumping between different tabs, digging through complex dashboards, and trying to figure out why an agent went offline or which files were modified. It's a lot of manual clicking that pulls you away from actual problem solving. This Wazuh MCP changes that by bringing your security stack directly into your AI conversation. You can ask your agent to pull manager logs, check cluster health, and audit security configurations in seconds. Instead of hunting for the right menu, you just ask questions. You can list all enrolled agents, filter them with specific queries, and perform bulk actions like restarting or upgrading them without ever touching the console. Whether you're verifying a log decoder, checking MITRE ATT&CK mappings, or updating a security rule, you get immediate answers. By using this through the Vinkius catalog, you bring your entire security posture into a single thread. You don't have to be a dashboard expert anymore; you just need to know what you're looking for.

## Tools

### list_decoders
List all loaded Wazuh decoders. Use WQL filtering to find specific ones quickly.

### delete_agents
Remove agents from your system. Use WQL to specify exactly which ones you want to delete.

### list_agents
See every agent enrolled in your Wazuh setup. It supports WQL filtering for easier searching.

### get_logtest
Test your rules and decoders against specific logs. This helps you validate your detection pipeline.

### get_manager_logs
Pull the logs from your Wazuh manager. This is useful for debugging daemon issues.

### get_manager_status
Check if the Wazuh manager daemon is running. Use this to ensure your system is online.

### restart_agents
Restart your Wazuh agents remotely. Use this to apply updates or clear hung processes.

### restart_cluster
Restart your entire Wazuh cluster. Use this when you need to perform maintenance on cluster nodes.

### get_rootcheck
Pull Rootcheck results from your agents. This helps identify unauthorized root access attempts.

### list_rules
See all the rules currently loaded in your Wazuh system. Use WQL filtering to find specific rule types.

### get_sca
Get Security Configuration Assessment results. Use WQL filtering to find specific compliance failures.

### list_security_users
See the list of users authorized on your Wazuh API. This helps you manage access.

### get_syscheck
Get File Integrity Monitoring results. Use WQL filtering to see which files were modified.

### get_syscollector
Pull your Syscollector inventory data. This gives you a clear picture of your endpoint hardware and software.

### update_rule_file
Modify a specific Wazuh rule file. This lets you fine-tune your detection logic on the fly.

### update_security_config
Change your Wazuh security configuration. Use this to update global security settings.

### upgrade_agents
Push updates to your Wazuh agents. This keeps your entire fleet running on the latest version.

### create_security_role
Create a new Wazuh security role. This helps you manage permissions for different users.

### get_mitre
Get MITRE ATT&CK results for your threats. Use WQL filtering to narrow down the results.

### list_cluster_nodes
See all nodes in your Wazuh cluster. Use this to monitor high availability.

### create_agent
Enroll a new agent into your Wazuh system. This makes onboarding new devices much faster.

## Prompt Examples

**Prompt:** 
```
Which agents are currently offline in my Wazuh setup?
```

**Response:** 
```
I've checked your agent list. Here are the currently offline nodes:

| Agent Name | IP Address | Last Seen |
| :--- | :--- | :--- |
| web-prod-01 | 192.168.1.45 | 2 hours ago |
| db-master-02 | 192.168.1.50 | 5 hours ago |

Would you like me to try restarting these agents for you?
```

**Prompt:** 
```
Show me the latest file integrity results for the production server.
```

**Response:** 
```
I've pulled the latest Syscheck results for 'prod-server-01'. 

**File Changes Detected:**
- `/etc/shadow` - Modified 14 minutes ago
- `/var/www/html/.htaccess` - Modified 12 minutes ago

I can also pull the Rootcheck results for this server if you'd like to see if there are any unauthorized root access attempts.
```

**Prompt:** 
```
What's the status of our Wazuh cluster?
```

**Response:** 
```
Checking your cluster health now...

**Cluster Status:** Healthy
- **Nodes:** 3 active, 0 down
- **Manager Daemon:** Running
- **Last Sync:** 30 seconds ago

Everything looks stable. Do you want to see the specific logs for any of these nodes?
```

## Capabilities

### Bulk update agents
Restart or upgrade your Wazuh agents across your entire fleet in one go.

### Query security audit results
Pull FIM, SCA, and Rootcheck results using natural language queries.

### Fetch MITRE ATT&CK mappings
Get instant visibility into how your threats map to known attacker tactics.

### Manage security rules
Update your Wazuh rule files and security configurations directly through your agent.

### Monitor manager health
Check your manager daemon status and pull logs to ensure high availability.

### Enroll new agents
Add new devices to your security infrastructure quickly using a simple command.

## Use Cases

### Responding to a suspected breach
An analyst asks their agent to pull manager logs and MITRE mappings for a specific alert. The agent uses get_manager_logs and get_mitre to provide a full picture of the threat in seconds.

### Auditing endpoint compliance
A security lead needs to find all agents with failed security checks. They ask the agent to pull SCA results using get_sca and filter for failed policies.

### Bulk agent maintenance
A DevSecOps engineer needs to update 200 agents. They ask the agent to run upgrade_agents on all nodes in a specific group to ensure everyone is on the latest version.

### Verifying a new detection rule
A developer creates a new rule and wants to see if it triggers correctly. They use get_logtest to run sample logs against their rules and verify the output.

## Benefits

- Stop clicking through dashboards by using get_syscheck to see file changes instantly.
- Keep your fleet current by using upgrade_agents to push updates to all endpoints at once.
- Speed up incident response by using get_mitre to see how threats map to known tactics.
- Save time on maintenance by using restart_agents to reboot hung processes remotely.
- Get a clear view of your infrastructure by using list_cluster_nodes to monitor high availability.
- Fine-tune your detection logic quickly by using update_rule_file to modify rules on the fly.

## How It Works

The bottom line is you get a conversational interface for your entire security stack.

1. Connect your Wazuh API URL and credentials to the Connector.
2. Link the Connector to your preferred AI client via the Vinkius platform.
3. Ask your agent to audit your agents, pull logs, or check cluster health.

## Frequently Asked Questions

**How does the Wazuh SIEM MCP help with incident response?**
It lets you pull manager logs and MITRE ATT&CK mappings instantly through your AI agent. Instead of hunting through a UI, you can get the data you need to understand a threat in a single chat.

**Can I use the Wazuh SIEM MCP to update my security rules?**
Yes, you can use it to modify your Wazuh rule files and security configurations. Your agent can handle the updates for you based on your instructions.

**Does the Wazuh SIEM MCP support bulk agent actions?**
It does. You can use your agent to restart or upgrade multiple Wazuh agents at once, which saves a lot of time on fleet maintenance.

**Is the Wazuh SIEM MCP good for auditing file changes?**
Yes, it's great for that. You can ask your agent to pull File Integrity Monitoring results to see exactly which files were modified across your infrastructure.

**How do I connect my Wazuh instance to the Connector?**
You just need to provide your Wazuh API URL and credentials. Once connected through Vinkius, your AI client can start querying your security data immediately.

**Can the Wazuh SIEM MCP check if my manager is running?**
Yes, it can check the manager daemon status and pull logs. This helps you ensure your SIEM infrastructure is healthy and available at all times.

**Can I filter agents by specific operating systems or versions?**
Yes! The `list_agents` tool supports WQL (Wazuh Query Language). You can use queries like `os.name=ubuntu;os.version>18` to find specific endpoints.

**How do I check for unauthorized file changes on my servers?**
You can use the `get_syscheck` tool. It retrieves File Integrity Monitoring (FIM) results, allowing you to audit file modifications, deletions, or additions across your agents.

**Is it possible to check the health of the Wazuh manager cluster?**
Absolutely. Use `get_manager_status` to check daemon health or `list_cluster_nodes` to see the status of all nodes in your Wazuh cluster.