Integrate Wazuh (SIEM) with Claude, Cursor, Chatbots & AI Agents MCP Server

Q: How do I check for unauthorized file changes on my servers?

You can use the get_syscheck tool. It retrieves File Integrity Monitoring (FIM) results, allowing you to audit file modifications, deletions, or additions across your agents.

Manage your Wazuh SIEM infrastructure—monitor agents, inspect security events, and manage manager configurations directly from your AI agent.

GDPR Free for Subscribers

Compatible with every major AI agent and IDE

Claude

ChatGPT

Cursor

Gemini

Windsurf

VS Code

JetBrains

Vercel

+ other MCP clients

create

Create agent on Wazuh (SIEM)

Enroll a new Wazuh agent

create

Create security role on Wazuh (SIEM)

Create a new Wazuh security role

delete

Delete agents on Wazuh (SIEM)

Use WQL to specify which agents to delete. Remove Wazuh agents

get

Get logtest on Wazuh (SIEM)

Test rules and decoders against logs

get

Get manager logs on Wazuh (SIEM)

Retrieve Wazuh manager logs

get

Get manager status on Wazuh (SIEM)

Get Wazuh manager daemon status

get

Get mitre on Wazuh (SIEM)

Supports WQL filtering. Get MITRE ATT&CK results

get

Get rootcheck on Wazuh (SIEM)

Supports WQL filtering. Get Rootcheck results

get

Get sca on Wazuh (SIEM)

Supports WQL filtering. Get Security Configuration Assessment (SCA) results

get

Get syscheck on Wazuh (SIEM)

Supports WQL filtering. Get File Integrity Monitoring (Syscheck) results

get

Get syscollector on Wazuh (SIEM)

Supports WQL filtering. Get Syscollector inventory

list

List agents on Wazuh (SIEM)

Supports WQL filtering. List all Wazuh agents

list

List cluster nodes on Wazuh (SIEM)

List Wazuh cluster nodes

list

List decoders on Wazuh (SIEM)

Supports WQL filtering. List loaded Wazuh decoders

list

List rules on Wazuh (SIEM)

Supports WQL filtering. List loaded Wazuh rules

list

List security users on Wazuh (SIEM)

List Wazuh API users

restart

Restart agents on Wazuh (SIEM)

Restart Wazuh agents

restart

Restart cluster on Wazuh (SIEM)

Restart the Wazuh cluster

update

Update rule file on Wazuh (SIEM)

Update a Wazuh rule file

update

Update security config on Wazuh (SIEM)

Update Wazuh security configuration

upgrade

Upgrade agents on Wazuh (SIEM)

Upgrade Wazuh agents

Security & Code Integrity Audit

Every tool in the Wazuh (SIEM) MCP Server is continuously audited by the Vinkius Security Engine. We guarantee zero-trust payload isolation, strict data boundaries, and deterministic execution for enterprise-grade AI agents.

A+Score: 100

How Vinkius protects your data

Is there a risk of the AI "going crazy" and deleting important company data?

No. With Vinkius, the AI operates on "rails". It can only make the exact moves you authorized in the tool's settings. It cannot invent routes, access other networks in your company, or decide to delete random files. If the action isn't in the approved catalog, the attempt is blocked instantly.

Can I audit what my AI agents are doing with this integration?

Yes, Vinkius provides an immutable, HMAC-chained audit log. Every tool execution, payload, and response is tracked in real-time on your dashboard, giving you complete visibility into your agent's actions.

How do I check for unauthorized file changes on my servers?

You can use the get_syscheck tool. It retrieves File Integrity Monitoring (FIM) results, allowing you to audit file modifications, deletions, or additions across your agents.

Does the AI train on my tools or API data?

No. Vinkius enforces a strict Zero-Retention policy. Your data simply passes through our secure servers to complete the requested action and is instantly forgotten. Nothing you do here is ever stored, logged, or used to train any artificial intelligence.

What can AI Agents do with Wazuh (SIEM)?

Integrate Wazuh (SIEM) to provide your custom AI agents with direct read and write access to the capabilities listed below.

Autonomous siem via AI

The Wazuh (SIEM) MCP manages API routing for siem. This enables AI agents like Claude Code to execute structured fort knox queries.

Cursor Copilot for threat detection

Integrate the Wazuh (SIEM) server to handle threat detection requests natively. It provides the schemas required for ChatGPT and Cursor to manage fort knox data.