An astronaut overseeing a futuristic data hub
Download PDFMarkdown Version

Connect Wazuh Siem to ChatGPT, Claude and Gemini

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Run security audits and manage endpoints through your AI agent.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

A futuristic MCP client docking bay
V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 21 capabilities

We ship only the actions that matter.

Capability set01 / 06

01-04

4 capabilities in this set.

Part of 21 available through Wazuh.

  1. 01

    List decoders

    This capability lists all loaded Wazuh decoders. It supports WQL filtering for specific searches.

  2. 02

    Get logtest

    Use this to test rules and decoders against specific log entries.

  3. 03

    Get manager logs

    This capability retrieves logs directly from the Wazuh manager.

  4. 04

    Get manager status

    Check the current status of the Wazuh manager daemon.

Capability set02 / 06

05-08

4 capabilities in this set.

Part of 21 available through Wazuh.

  1. 05

    Get rootcheck

    This capability pulls Rootcheck results and supports WQL filtering.

  2. 06

    Restart cluster

    Use this to trigger a restart of the Wazuh cluster.

  3. 07

    Get sca

    This capability retrieves Security Configuration Assessment results using WQL filtering.

  4. 08

    List security users

    Get a list of all users configured in the Wazuh API.

Capability set03 / 06

09-12

4 capabilities in this set.

Part of 21 available through Wazuh.

  1. 09

    Get syscheck

    This capability fetches File Integrity Monitoring results with WQL filtering support.

  2. 10

    Get syscollector

    Retrieve the current inventory from the Syscollector using WQL filtering.

  3. 11

    Update rule file

    Use this to modify a Wazuh rule file directly.

  4. 12

    Update security config

    This capability allows you to update the Wazuh security configuration.

Capability set04 / 06

13-15

3 capabilities in this set.

Part of 21 available through Wazuh.

  1. 13

    Get mitre

    Retrieve MITRE ATT&CK mapping results with WQL filtering.

  2. 14

    List cluster nodes

    Get a list of all active nodes in the Wazuh cluster.

  3. 15

    Create agent

    Enroll a new agent into your Wazuh environment.

Capability set05 / 06

16-18

3 capabilities in this set.

Part of 21 available through Wazuh.

  1. 16

    Create security role

    Use this to set up a new security role in Wazuh.

  2. 17

    Delete agents

    Remove agents from the system using WQL to specify targets.

  3. 18

    List agents

    Get a list of all enrolled agents using WQL filtering.

Capability set06 / 06

19-21

3 capabilities in this set.

Part of 21 available through Wazuh.

  1. 19

    List rules

    Retrieve the list of loaded Wazuh rules with WQL filtering.

  2. 20

    Restart agents

    Trigger a restart for your Wazuh agents.

  3. 21

    Upgrade agents

    Use this to perform agent upgrades across your fleet.

Real work

What teams actually run

01

Rapid Incident Investigation

Pull manager logs and Syscheck results immediately when a security alert triggers.

02

Automated Fleet Maintenance

Run agent upgrades or restarts across multiple endpoints using a single command.

03

Compliance Monitoring

Check SCA and Rootcheck results to ensure endpoints meet security standards.

04

Detection Engineering

Test new decoders and update rule files to refine your detection capabilities.

Automate a task

Put Wazuh to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

Wazuh works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

ClaudeClaudeChatGPTChatGPTGeminiGeminiPerplexityPerplexityGrokGrokMicrosoft CopilotMicrosoft CopilotCursorCursorVS CodeVS CodeWindsurfWindsurfJetBrainsJetBrainsClineClineLangChainLangChainVercel AI SDKVercel AI SDKLovableLovableZ.aiZ.aiRaycastRaycastQwen CodeQwen CodeKimi CodeKimi CodeLe ChatLe Chat

Building your own app? The connector is yours to use.

You don't need a client to put Wazuh to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

993ms average. Fast in production.

Wazuh is checked daily against the live service.

Daily averagePeak 1207ms
Oct 3Today
Fastest day
774ms
Slowest day
1207ms
14-day trend
Slowing+24%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 21 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of Wazuh, so you can see the experience inside your AI.

It does not authenticate your account with Wazuh. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

Wazuh Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_REUf3LN8uLwAvmnqLRFwWwNJqnVgVW6WS1Ew5q4A/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Wazuh capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "wazuh-siem-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_REUf3LN8uLwAvmnqLRFwWwNJqnVgVW6WS1Ew5q4A/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up Wazuh in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work Wazuh owners hand off.

This MCP is built for technical security professionals who need to interact with Wazuh without constantly switching to the web dashboard.

  • 01

    Security Analysts

    They use the agent to quickly query agent status and FIM results during investigations.

  • 02

    DevSecOps Engineers

    They use the agent to automate agent upgrades and monitor cluster health from the terminal.

  • 03

    Incident Responders

    They use the agent to pull manager logs and MITRE mappings instantly when responding to threats.

FAQ

Questions Wazuh owners ask.

  • 01

    How do I connect my Wazuh instance?

    You provide your Wazuh API URL and credentials to Vinkius. Once connected, the MCP is ready to use in any compatible client.

  • 02

    Can I filter my agent queries?

    Yes, many capabilities in this MCP support WQL filtering to help you target specific agents or data sets.

  • 03

    Does this MCP support agent upgrades?

    Yes, you can use the upgrade_agents capability to manage version updates for your enrolled agents.

  • 04

    Is my Wazuh data secure?

    Vinkius manages the connection and credentials, allowing your AI client to interact with your API securely.

  • 05

    Can I modify rules through my AI client?

    Yes, the update_rule_file capability allows you to change Wazuh rules directly through your agent.

  • 06

    Can I filter agents by specific operating systems or versions?

    Yes! The list_agents capability supports WQL (Wazuh Query Language). You can use queries like os.name=ubuntu;os.version>18 to find specific endpoints.

  • 07

    How do I check for unauthorized file changes on my servers?

    You can use the get_syscheck capability. It retrieves File Integrity Monitoring (FIM) results, allowing you to audit file modifications, deletions, or additions across your agents.

  • 08

    Is it possible to check the health of the Wazuh manager cluster?

    Absolutely. Use get_manager_status to check daemon health or list_cluster_nodes to see the status of all nodes in your Wazuh cluster.

Explore

More in Fort Knox

Suggestions

Connect Wazuh to Claude, Cursor, ChatGPT & more