How to Use the Wazuh (SIEM) MCP in LlamaIndex

Q: Can I use LlamaIndex to track Wazuh (SIEM) configuration changes?

Yes. By indexing the results from updatesecurityconfig and related listing tools, you build a timeline. You can query 'When did we last change the security role?' and get an answer grounded in the API data.

Build searchable knowledge bases from Wazuh (SIEM) logs using LlamaIndex.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Wazuh (SIEM) MCP to LlamaIndex

Create your Vinkius account to connect Wazuh (SIEM) to LlamaIndex and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Wazuh (SIEM) with LlamaIndex

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Indexing Agent Status and Inventory

You start by calling `list_agents` to get a full inventory of endpoints. This output immediately becomes part of your searchable knowledge base index. Later, if you need the current cluster nodes, run `list_cluster_nodes`, adding that data point too. LlamaIndex then lets you query past sessions—'What was the agent status when we ran this last month?'—grounding answers in actual API results.

Semantic Search for Security Findings

When investigating, use `get_rootcheck` to collect a report. This full report is then indexed into your vector store. Need to reference it later? You query the index semantically—'Show me all rootcheck findings related to privilege escalation.' This means you can ask natural language questions and get answers based on the raw data from the MCP Server.

Historical Rule and Decoder Review

Don't rely on memory. Use `list_rules` to pull all current rules, then index that list. If a team member asks about an old rule set, you query the knowledge base instead of running a live call. This ability to combine historical API data with documents makes your RAG application genuinely powerful.

Setup guide

Set up Wazuh (SIEM) MCP in LlamaIndex

Prerequisites

Python 3.10+ installed
llama-index-tools-mcp package
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install llama-index-tools-mcp llama-index-llms-openai. The MCP tools package provides BasicMCPClient and McpToolSpec.
2

Connect with BasicMCPClient
Point BasicMCPClient to your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. Supports SSE and Streamable HTTP transports.
3

Convert to LlamaIndex tools
Call mcp_tool_spec.to_tool_list_async() to convert all Wazuh (SIEM) MCP tools into native FunctionTool objects that any LlamaIndex agent can use.
4

Run with any LLM
Create a FunctionAgent with the tools and your preferred LLM. Swap OpenAI for Anthropic, Gemini, or any LlamaIndex-supported provider.

agent.py

from llama_index.tools.mcp import BasicMCPClient, McpToolSpec
from llama_index.core.agent.workflow import FunctionAgent
from llama_index.llms.openai import OpenAI

# Connect to the MCP
mcp_client = BasicMCPClient(
    "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)
mcp_tool_spec = McpToolSpec(client=mcp_client)

# Convert MCP tools to LlamaIndex tools
tools = await mcp_tool_spec.to_tool_list_async()

# Create and run the agent
agent = FunctionAgent(
    tools=tools,
    llm=OpenAI(model="gpt-4o"),
    system_prompt="You have access to Wazuh (SIEM) tools.",
)
response = await agent.run("List recent Wazuh (SIEM) data")

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Wazuh. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Wazuh (SIEM) now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Wazuh (SIEM) MCP in LlamaIndex

It takes the raw output from the MCP Server—like agent lists or rule results—and turns it into a searchable knowledge base. You move beyond simple queries to true semantic understanding of your security posture.

Yes. By indexing the results from `update_security_config` and related listing tools, you build a timeline. You can query 'When did we last change the security role?' and get an answer grounded in the API data.

The server exposes agents, rules, decoders, and various reports like file integrity monitoring results. All of these structured outputs become indexed knowledge objects for your application.

The underlying MCP Server tools do. You can filter data using WQL—for example, only listing agents from a specific geographic location before indexing that subset of data.

This server touches agent status and historical security events. You must ensure all indexed data respects your organization's retention policies before passing it to the vector store.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript