wazuh
pipStandardThe Wazuh MCP server integrates Wazuh's SIEM capabilities with LLMs for intelligent security data analysis. It exposes Wazuh's alert management, vulnerability detection, and compliance monitoring tools. Connects to Wazuh's API for real-time security event data. Useful for security analysts and DevOps teams automating threat detection and response.
74250Updated 5 months ago
Overview
The Wazuh MCP server integrates Wazuh's SIEM capabilities with LLMs for intelligent security data analysis. It exposes Wazuh's alert management, vulnerability detection, and compliance monitoring tools. Connects to Wazuh's API for real-time security event data. Useful for security analysts and DevOps teams automating threat detection and response.
Installation
1Install the package
pip
pip install wazuh-mcp-server2Add to Claude
Add this configuration to your claude_desktop_config.json:
claude_desktop_config.json
{
"mcpServers": {
"socfortress-wazuh-mcp-server-github": {
"command": "uvx",
"args": [
"pip install wazuh-mcp-server"
]
}
}
}3Verify installation
Restart Claude Desktop, then ask:
"What tools do you have available from wazuh?"
Prerequisites
- Python 3.10 or higher
- pip or uv package manager
- Claude Desktop or Claude API access
- API key for wazuh
Configuration
API Key Required
This server requires an API key from wazuh. Add it to your environment or config.
| Variable | Required | Description |
|---|---|---|
| WAZUH_API_KEY | Yes | Your wazuh API key |
Usage Examples
List Resources
"What resources are available in wazuh?"
Claude will query available resources and return a list of what you can access.
Get Details
"Show me details about [specific item] in wazuh"
Claude will fetch and display detailed information about the requested item.
Create New
"Create a new [item] in wazuh with [details]"
Claude will use the appropriate tool to create the resource and confirm success.
Works with wazuh
Related skills
Browse all skillsNeed help with MCP integration?
We build custom MCP integrations for B2B companies. From simple connections to complex multi-tool setups.