Download PDFMarkdown Version
ClaudeChatGPTPerplexityGeminiMicrosoft CopilotRaycastMeta AIGrokZ.aiQwenKimi
DeepSeekMistralCursorVS CodeWindsurfJetBrainsClineLovableVercel AI SDKLangChain

Use Wazuh with your AI.

Connect your account once and let the AI you already use work with it, without building another integration. Manage your Wazuh SIEM infrastructure—monitor agents, inspect security events, and manage manager configurations directly from your AI agent.

Included with plan

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Complete set · 21 capabilities

The complete Wazuh capability set.

These are the exact actions your AI can choose when you ask it to work with Wazuh.

Capability set01 / 06

01-04

4 capabilities in this set.

Part of 21 available through Wazuh.

  1. 01

    List decoders

    Supports WQL filtering. List loaded Wazuh decoders

  2. 02

    Get logtest

    Test rules and decoders against logs

  3. 03

    Get manager logs

    Retrieve Wazuh manager logs

  4. 04

    Get manager status

    Get Wazuh manager daemon status

Capability set02 / 06

05-08

4 capabilities in this set.

Part of 21 available through Wazuh.

  1. 05

    Get rootcheck

    Supports WQL filtering. Get Rootcheck results

  2. 06

    Restart cluster

    Restart the Wazuh cluster

  3. 07

    Get sca

    Supports WQL filtering. Get Security Configuration Assessment (SCA) results

  4. 08

    List security users

    List Wazuh API users

Capability set03 / 06

09-12

4 capabilities in this set.

Part of 21 available through Wazuh.

  1. 09

    Get syscheck

    Supports WQL filtering. Get File Integrity Monitoring (Syscheck) results

  2. 10

    Get syscollector

    Supports WQL filtering. Get Syscollector inventory

  3. 11

    Update rule file

    Update a Wazuh rule file

  4. 12

    Update security config

    Update Wazuh security configuration

Capability set04 / 06

13-15

3 capabilities in this set.

Part of 21 available through Wazuh.

  1. 13

    Get mitre

    Supports WQL filtering. Get MITRE ATT&CK results

  2. 14

    List cluster nodes

    List Wazuh cluster nodes

  3. 15

    Create agent

    Enroll a new Wazuh agent

Capability set05 / 06

16-18

3 capabilities in this set.

Part of 21 available through Wazuh.

  1. 16

    Create security role

    Create a new Wazuh security role

  2. 17

    Delete agents

    Use WQL to specify which agents to delete. Remove Wazuh agents

  3. 18

    List agents

    Supports WQL filtering. List all Wazuh agents

Capability set06 / 06

19-21

3 capabilities in this set.

Part of 21 available through Wazuh.

  1. 19

    List rules

    Supports WQL filtering. List loaded Wazuh rules

  2. 20

    Restart agents

    Restart Wazuh agents

  3. 21

    Upgrade agents

    Upgrade Wazuh agents

Observed, not estimated

931ms average. Fast in production.

Wazuh is checked daily against the live service.

Daily averagePeak 1129ms
Aug 20Today
Fastest day
769ms
Slowest day
1129ms
14-day trend
Slowing+12%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 21 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of Wazuh, so you can see the experience inside your AI.

It does not authenticate your account with Wazuh. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

Wazuh Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_REUf3LN8uLwAvmnqLRFwWwNJqnVgVW6WS1Ew5q4A/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Wazuh capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "wazuh-siem-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_REUf3LN8uLwAvmnqLRFwWwNJqnVgVW6WS1Ew5q4A/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

FAQ

Questions Wazuh owners ask.

  • 01

    Can I filter agents by specific operating systems or versions?

    Yes! The list_agents capability supports WQL (Wazuh Query Language). You can use queries like os.name=ubuntu;os.version>18 to find specific endpoints.

  • 02

    How do I check for unauthorized file changes on my servers?

    You can use the get_syscheck capability. It retrieves File Integrity Monitoring (FIM) results, allowing you to audit file modifications, deletions, or additions across your agents.

  • 03

    Is it possible to check the health of the Wazuh manager cluster?

    Absolutely. Use get_manager_status to check daemon health or list_cluster_nodes to see the status of all nodes in your Wazuh cluster.

Explore

More in Fort Knox

Suggestions