Wazuh SIEM Agent System

A Claude-powered MCP tool suite for interacting with a Wazuh SIEM manager. Exposes Wazuh REST API capabilities as MCP tools so Claude can triage alerts, monitor agent health, hunt threats, manage rules, and propose/execute active responses.

Architecture

wazuh-agent/
├── mcp/
│   └── wazuh_mcp_server.py   # MCP server — all tools registered here
├── agents/
│   ├── orchestrator.py        # Routes queries to the right specialist agent
│   ├── triage.py              # Alert severity analysis & MITRE mapping
│   ├── health.py              # Fleet connectivity & health checks
│   ├── hunting.py             # IOC search & behavioural pattern detection
│   ├── rules.py               # Rule analysis & coverage gaps
│   └── response.py            # Active response proposals & gated execution
├── config.py                  # Connection settings (credentials via env vars)
└── requirements.txt

The MCP server imports analysis functions from each agent module and exposes them as MCP tools. Claude (via Claude Code or another client) uses these tools to reason over real-time Wazuh data.

Setup

1. Install dependencies

pip install -r requirements.txt

2. Set credentials

Create a .env file (never commit this):

WAZUH_USER=your_api_user
WAZUH_PASSWORD=your_api_password

Or set environment variables directly in your shell.

3. Register the MCP server with Claude Code

Add to your Claude Code MCP settings (claude_desktop_config.json or .claude/settings.json):

{
  "mcpServers": {
    "wazuh": {
      "command": "python",
      "args": ["G:/claudeai/wazuh-agent/mcp/wazuh_mcp_server.py"],
      "env": {
        "WAZUH_USER": "${WAZUH_USER}",
        "WAZUH_PASSWORD": "${WAZUH_PASSWORD}"
      }
    }
  }
}

Available MCP Tools

Raw API tools

Tool	Description
get_agents	List all agents by status
get_agent_details	Details for a specific agent
get_alerts	Recent alerts with optional level/agent filter
get_manager_info	Manager version and status
get_manager_stats	Events/alerts per hour
get_agent_processes	Running processes (syscollector)
get_agent_ports	Open ports (syscollector)
get_agent_packages	Installed packages (syscollector)
get_agent_vulnerabilities	CVEs by agent and severity
get_rules	Search detection rules
get_rule_by_id	Look up a specific rule

Analysis tools

Tool	Description
triage_alerts	Severity buckets, top rules, MITRE tactic counts
check_health	Fleet health: disconnected/stale agents, unknowns
hunt_ioc	Search all alerts for an IP, hash, domain, or username
hunt_patterns	Detect brute-force, lateral movement, priv-esc patterns
analyze_rules	Rule coverage summary and category breakdown
propose_response	Ranked active-response options (no execution)
execute_active_response	Execute a response — requires confirmed=True

Known Agents

ID	Name	Notes
000	wazuh	Manager
001	kali
002	Area-51
003	Prism
004	DESKTOP-GPLJ6GT
005	vert-server
006	pve610	Disconnected
007	pve720XD
008	pve720

Safety — Active Response

Active response commands modify target systems immediately and some are irreversible.

The workflow is always:

1. Call propose_response(agent_id, threat_summary) → review options
2. Present proposals to the user and get explicit approval
3. Call execute_active_response(..., confirmed=True) only after approval

execute_active_response called without confirmed=True returns a blocked status and never touches the Wazuh API.