How to Use the Wazuh (SIEM) MCP in Mastra AI

Q: How do I run a basic threat hunt query using Wazuh (SIEM) and Mastra AI?

You call the getmitre tool, specifying your required WQL filter. Since this is part of a workflow engine, if the query fails, you can set up an automatic retry with different parameters.

Q: Can I check manager logs using Wazuh (SIEM) and Mastra AI?

Yes, use getmanagerlogs. Your workflow can process these logs—for example, if a critical error is found, it triggers an alert notification step.

Q: What if I need to verify agent enrollment using Wazuh (SIEM) and Mastra AI?

Check the full list of agents with listagents. If any are missing or outdated, your workflow can automatically trigger an upgrade via upgradeagents.

Q: Does this MCP Server support deleting agents using Wazuh (SIEM) and Mastra AI?

It supports it. You use deleteagents with WQL to precisely target the agents you need removed, making cleanup part of your automated remediation steps.

Q: What data type is handled when I update the Wazuh rules via Mastra AI?

This server manages rule file definitions. You use updaterulefile to push new rule sets, which can then be validated by subsequent steps in your complex workflow.

Build complex Wazuh (SIEM) workflows that handle failures with Mastra AI agent framework.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Wazuh (SIEM) MCP to Mastra AI

Create your Vinkius account to connect Wazuh (SIEM) to Mastra AI and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Wazuh (SIEM) with Mastra AI

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Automate Agent Provisioning with MCP Server

Need to onboard a bunch of new endpoints? Use `create_agent` to enroll agents in Wazuh automatically. This tool makes sure every node gets connected and monitored. You can also scale down by calling `delete_agents`, specifying the targets via WQL.

Audit SIEM Infrastructure using Mastra AI

Building complex workflows requires reliable status checks. Use `get_manager_status` to confirm the Wazuh manager daemon is running properly. Checking cluster health? Call `list_cluster_nodes`. If any node goes down, your workflow can catch it and retry.

Assess Security Posture with Mastra AI

For compliance workflows, you need to check the security state. Run `get_mitre` for a detailed MITRE ATT&CK analysis or use `get_rootcheck` for system integrity checks. These tools give specific results that your multi-step workflow can process, whether it's checking configuration via `get_sca`.

Setup guide

Set up Wazuh (SIEM) MCP in Mastra AI

Prerequisites

Node.js 18+ and a TypeScript project
@mastra/mcp + @mastra/core packages
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run npm install @mastra/mcp @mastra/core plus your preferred model provider (e.g. @ai-sdk/openai).
2

Configure the MCPClient
Create an MCPClient with your Vinkius endpoint as a URL object. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com.
3

Discover and inject tools
Call mcpClient.listTools() and spread the result into your agent's tools object. All Wazuh (SIEM) tools become native Mastra tools.
4

Run with any model
Swap openai("gpt-4o") for any AI SDK-compatible provider. Call agent.generate() and the agent routes tool calls through MCP automatically.

agent.ts

import { MCPClient } from "@mastra/mcp";
import { Agent } from "@mastra/core/agent";
import { openai } from "@ai-sdk/openai";

const mcpClient = new MCPClient({
  id: "wazuh-siem-mcp-client",
  servers: {
    "wazuh-siem-mcp": {
      url: new URL(
        "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
      ),
    },
  },
});

const agent = new Agent({
  name: "Wazuh (SIEM) Agent",
  model: openai("gpt-4o"),
  instructions: "You have access to Wazuh (SIEM) tools.",
  tools: {
    ...(await mcpClient.listTools()),
  },
});

const result = await agent.generate(
  "List recent Wazuh (SIEM) transactions"
);
console.log(result.text);

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Wazuh. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Wazuh (SIEM) now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Wazuh (SIEM) MCP in Mastra AI

You call the `get_mitre` tool, specifying your required WQL filter. Since this is part of a workflow engine, if the query fails, you can set up an automatic retry with different parameters.

Yes, use `get_manager_logs`. Your workflow can process these logs—for example, if a critical error is found, it triggers an alert notification step.

Check the full list of agents with `list_agents`. If any are missing or outdated, your workflow can automatically trigger an upgrade via `upgrade_agents`.

It supports it. You use `delete_agents` with WQL to precisely target the agents you need removed, making cleanup part of your automated remediation steps.

This server manages rule file definitions. You use `update_rule_file` to push new rule sets, which can then be validated by subsequent steps in your complex workflow.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript