• CONTEXT
  • SCOPE
  • LOGS
  • HUMAN

How to investigate security alerts with your AI

Connect Wazuh to your AI client to bridge the gap between a raw alert and a full investigation. Your agent handles the data gathering so you can focus on the response.

Ask AI about this page

Short answer

How do I investigate security alerts with my AI?

Your AI pulls manager logs, Syscheck data, and MITRE mappings directly from Wazuh to contextualize alerts. This gives you a complete picture of the threat without manual log hunting. You get a structured breakdown of the incident's scope and impact.

Investigation outcomes

Where your findings land.

The AI organizes the data it pulls into these specific outcomes.

CONTEXT

Mapped threat intelligence

The AI matches your alert to MITRE ATT&CK techniques. You see exactly what stage an attacker is in.

SCOPE

System integrity checks

The agent pulls Syscheck results to show file changes or unauthorized modifications. You see what actually changed on the host.

LOGS

Centralized event history

The AI pulls manager logs to reconstruct the timeline of the alert. You get a clear sequence of events.

HUMAN

Decision ready reports

The AI presents the findings in a way that requires your final judgment. You decide if the alert is a true positive.

The workflow

What your AI does when an alert arrives.

The AI acts as your primary investigator by pulling data from Wazuh.

  1. Gathering event history

    The agent pulls the relevant manager logs to see the raw event data surrounding the alert.

    get_manager_logs

  2. Checking file integrity

    The AI looks at Syscheck results to identify any suspicious file modifications or new files on the affected system.

    get_syscheck

  3. Mapping to MITRE

    The agent pulls MITRE mappings to identify the specific tactics and techniques used in the attack.

    get_mitre

  4. Scanning for rootkits

    The AI runs a rootcheck to see if the system shows signs of deep-level compromise or hidden processes.

    get_rootcheck

Try it

Copy these to start.

Use these prompts to kick off an investigation.

Starting points

These are starting points. Swap out the specific alert IDs or hostnames with your actual Wazuh data.

Wazuh Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_REUf3LN8uLwAvmnqLRFwWwNJqnVgVW6WS1Ew5q4A/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Wazuh capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "wazuh-siem-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_REUf3LN8uLwAvmnqLRFwWwNJqnVgVW6WS1Ew5q4A/mcp"
    }
  }
}
Copy into chat04

  • Analyze this Wazuh alert ID 4521 and pull the manager logs to explain what happened.

  • Check the Syscheck results for host 'web-server-01' to see if any system files were modified during this alert.

  • What MITRE ATT&CK techniques are associated with this specific Wazuh alert?

  • Run a rootcheck on the affected agent to see if there are any signs of a kernel-level compromise.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Wazuh once, then ask.

You only need to link your Wazuh instance once. Your credentials stay encrypted, and you can immediately start asking your AI about your security data.

Connect Wazuh to your AI

FAQ

How this task behaves

  • 01

    Can the AI fix the security issue?

    No. The AI only reads data from Wazuh to help you investigate. You must perform the remediation yourself.

  • 02

    Can the AI delete logs in Wazuh?

    No. The tools only allow the AI to read logs and system data. It cannot modify or delete anything in your Wazuh manager.

  • 03

    Does the AI need my Wazuh password?

    No. Your credentials are encrypted and managed by Vinkius. The AI uses the connection to pull data, but it doesn't see your raw password.

  • 04

    Can I use this with any AI client?

    Yes, as long as the client supports the Model Context Protocol (MCP), like Claude, Cursor, or Windsurf.

  • 05

    How does the AI know which logs to pull?

    The AI uses the manager logs tool to fetch the specific event data you ask for based on the alert ID or timestamp you provide.

  • More questions about Wazuh? See everything the Wazuh Connector can do

Connect Wazuh to Claude, Cursor, ChatGPT & more