How to Use the Wazuh (SIEM) MCP in CrewAI

Q: How do I run a basic threat hunt query using Wazuh (SIEM) and CrewAI?

A research agent uses the getmitre tool, passing specific WQL filters. The analysis agent then takes those raw results and generates a summary report for you.

Q: What if I need to verify agent enrollment using Wazuh (SIEM) and CrewAI?

A monitor agent runs listagents to confirm every endpoint is accounted for. The system can then use restartagents if a subset of agents appears inactive.

Q: Does this MCP Server support deleting agents using Wazuh (SIEM) and CrewAI?

The crew handles deletion via the deleteagents tool, allowing you to define which agents must be removed using WQL criteria before a cleanup phase.

Q: What data type is handled when I update the Wazuh rules via CrewAI?

This server manages rule definitions. You use updaterulefile to push new rules, and a subsequent validation step can call getlogtest to ensure the new rules fire correctly.

Build autonomous operations with Wazuh (SIEM) data using CrewAI multi-agent TEAMS.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Wazuh (SIEM) MCP to CrewAI

Create your Vinkius account to connect Wazuh (SIEM) to CrewAI and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Wazuh (SIEM) with CrewAI

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Monitor and Control Agents with MCP Server

Building an ops crew requires constant oversight. The `list_agents` tool lets a monitor agent check the status of all Wazuh agents. A specialized action agent can also call `restart_cluster` if performance dips, ensuring continuous monitoring for your team.

Systematically Audit Wazuh (SIEM) Settings

Need to check the system's security posture? A dedicated analysis agent runs `get_sca` and `get_syscheck`. These tools provide detailed results for a comprehensive audit. The crew can even use `list_decoders` and `list_rules` to map out exactly what logic is running in your SIEM.

Full Lifecycle Management via CrewAI

The team handles agent lifecycle. One agent calls `create_agent`, while another runs `get_syscollector` to inventory the system. This full cycle can be automated and monitored. When done, a final action can call `list_security_users` to confirm roles are correct.

Setup guide

Set up Wazuh (SIEM) MCP in CrewAI

Prerequisites

Python 3.10+ installed
crewai package (pip install crewai)
Active Vinkius subscription with a valid endpoint token

1

Install CrewAI
Run pip install crewai to install the framework. MCP support is built-in via the mcps parameter.
2

Add the MCP URL to your agent
Pass your Vinkius endpoint directly to the mcps list. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. CrewAI handles tool discovery and caching automatically.
3

Kick off your crew
Create a Crew with your agent and tasks. Call crew.kickoff() — the agent will automatically invoke Wazuh (SIEM) tools as needed.

crew.py

from crewai import Agent, Task, Crew

agent = Agent(
    role="Wazuh (SIEM) Analyst",
    goal="Access and analyze Wazuh (SIEM) data via MCP.",
    backstory="Expert analyst with direct Wazuh (SIEM) access.",
    mcps=[
        "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ],
)

task = Task(
    description="List recent Wazuh (SIEM) transactions",
    agent=agent,
    expected_output="A summary of recent activity",
)

crew = Crew(agents=[agent], tasks=[task])
result = crew.kickoff()
print(result)

Get your connection token →

Prerequisites

Python 3.10+ installed
crewai + crewai-tools packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install crewai crewai-tools. The MCPServerAdapter handles lifecycle management and tool conversion.
2

Connect with MCPServerAdapter
Use MCPServerAdapter as a context manager with SseServerParameters pointing to your Vinkius endpoint. The adapter automatically manages connection lifecycle.
3

Assign tools and run
Pass the returned mcp_tools to your agent's tools parameter. The adapter converts MCP tools to native BaseTool objects compatible with all CrewAI agents.

crew.py

from crewai import Agent, Task, Crew
from crewai_tools import MCPServerAdapter
from mcp import SseServerParameters

server_params = SseServerParameters(
    url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)

with MCPServerAdapter(server_params) as mcp_tools:
    agent = Agent(
        role="Wazuh (SIEM) Analyst",
        goal="Access and analyze Wazuh (SIEM) data via MCP.",
        backstory="Expert analyst with direct Wazuh (SIEM) access.",
        tools=mcp_tools,
    )

    task = Task(
        description="List recent Wazuh (SIEM) transactions",
        agent=agent,
        expected_output="A summary of recent activity",
    )

    crew = Crew(agents=[agent], tasks=[task])
    result = crew.kickoff()
    print(result)

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Wazuh. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Wazuh (SIEM) now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Wazuh (SIEM) MCP in CrewAI

A research agent uses the `get_mitre` tool, passing specific WQL filters. The analysis agent then takes those raw results and generates a summary report for you.

Yes. You assign the task of checking logs to an action agent, which calls `get_manager_logs`. This ensures that log review is a structured, documented part of the crew's output.

A monitor agent runs `list_agents` to confirm every endpoint is accounted for. The system can then use `restart_agents` if a subset of agents appears inactive.

The crew handles deletion via the `delete_agents` tool, allowing you to define which agents must be removed using WQL criteria before a cleanup phase.

This server manages rule definitions. You use `update_rule_file` to push new rules, and a subsequent validation step can call `get_logtest` to ensure the new rules fire correctly.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript