How to Use the Wazuh (SIEM) MCP in OpenAI Agents SDK

Q: How does the OpenAI Agents SDK handle Wazuh (SIEM) agent management?

The agents use createagent to enroll new endpoints. They also support deleteagents, allowing you to prune old or decommissioned systems using WQL filtering.

Q: Can the OpenAI Agents SDK help check Wazuh (SIEM) compliance?

Absolutely. The agent can run assessments like getsca for Security Configuration Assessment results, ensuring your rules meet industry benchmarks.

Q: What is the best way to use Wazuh (SIEM) with the OpenAI Agents SDK?

You'll want to combine agent management (listagents) with threat detection checks like getsyscheck. This provides a comprehensive view of both operational status and security posture.

Q: Does the MCP Server support Wazuh (SIEM) rule updates?

Yes, you can update rules using updaterulefile or modify core settings with updatesecurityconfig. These actions are critical for maintaining detection relevance.

Monitor your entire infrastructure using the OpenAI Agents SDK.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Wazuh (SIEM) MCP to OpenAI Agents SDK

Create your Vinkius account to connect Wazuh (SIEM) to OpenAI Agents SDK and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Wazuh (SIEM) with OpenAI Agents SDK

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Manage Wazuh Agents and Nodes via MCP Server

Need to onboard new systems? Use `create_agent` to enroll a fresh agent into the cluster. You can also manage existing endpoints with `delete_agents`, specifying agents using WQL filters. Furthermore, keep your deployment current by running `upgrade_agents` or restarting services directly via `restart_cluster`. Your AI client handles this interaction safely.

Test Threat Detection Rules

Before deploying new rules, you gotta test them. Run `get_logtest` to check if your decoders and rules properly interpret incoming logs. You can also verify system integrity using specialized checks like `get_mitre`, which supports WQL filtering. This helps validate detections against known threat patterns without risking a live false positive.

Audit Security Configuration

Inspect the health of your entire SIEM stack. Call `get_manager_status` to check if the manager daemon is running smoothly, or retrieve detailed logs using `get_manager_logs`. For a full picture, you can list all available agents with `list_agents`. These tools give your agent visibility into core operational metrics.

Setup guide

Set up Wazuh (SIEM) MCP in OpenAI Agents SDK

Prerequisites

Python 3.10+ installed
openai-agents package (pip install openai-agents)
Active Vinkius subscription with a valid endpoint token

1

Install the SDK

Run pip install openai-agents to install the OpenAI Agents SDK. The MCP integration is built-in — no extra dependencies needed.
2

Connect via SSE transport

Use MCPServerSse with your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. The SDK auto-discovers all Wazuh (SIEM) tools at runtime.
3

Create your Agent

Pass the MCP to Agent(mcp_servers=[server]). The agent receives Wazuh (SIEM) tools as native definitions — JSON schemas resolve automatically.
4

Run the agent

Call Runner.run(agent, prompt) to execute. The agent invokes the appropriate Wazuh (SIEM) tools and returns structured results. Copy the full example on the right to get started.

agent.py

import asyncio
from agents import Agent, Runner
from agents.mcp import MCPServerSse

async def main():
    async with MCPServerSse(
        url="https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    ) as server:
        agent = Agent(
            name="Wazuh (SIEM) Agent",
            instructions="You have access to Wazuh (SIEM) tools.",
            mcp_servers=[server],
        )
        result = await Runner.run(agent, "List recent transactions")
        print(result.final_output)

asyncio.run(main())

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Wazuh. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Wazuh (SIEM) now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Wazuh (SIEM) MCP in OpenAI Agents SDK

The agents use `create_agent` to enroll new endpoints. They also support `delete_agents`, allowing you to prune old or decommissioned systems using WQL filtering.

Absolutely. The agent can run assessments like `get_sca` for Security Configuration Assessment results, ensuring your rules meet industry benchmarks.

You'll want to combine agent management (`list_agents`) with threat detection checks like `get_syscheck`. This provides a comprehensive view of both operational status and security posture.

Yes, you can update rules using `update_rule_file` or modify core settings with `update_security_config`. These actions are critical for maintaining detection relevance.

This server handles operational and security event logs. The agent interacts directly with Agent lists and system configuration details when running tasks.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript