adi5353/wazuh-mcp

이 페이지는 AI로 자동 번역되었습니다. 기술적인 세부 사항은 원문을 확인하세요. 원문 보기

15 stars 6 forks 품질 75 트렌드 25Apache-2.0

across 21 domain modules — alerts, vulnerabilities, FIM, compliance, MITRE ATT&CK, threat hunting, active response, fleet inventory, SCA, CDB lists, rules, threat intel, incidents, reporting,...

개요

across 21 domain modules — alerts, vulnerabilities, FIM, compliance, MITRE ATT&CK, threat hunting, active response, fleet inventory, SCA, CDB lists, rules, threat intel, incidents, reporting, notifications, onboarding, cluster health, archive search, and alert suppression. This is the recommended deployment method. The container bundles all dependencies and exposes the MCP server on port 8000. Use this if you want to run directly on the Wazuh server without Docker. Install mcp-remote on the machine running Claude Desktop (requires Node.js 18+): Fully quit Claude Desktop (tray icon → ) and relaunch. You should see the tools icon in the chat input. If Claude Desktop and the MCP server run on the same machine, use stdio transport: Available as / commands in Claude Code and prompt-aware clients. All integrations are opt-in. Tools degrade gracefully if credentials are absent.

README

원문 README의 일부입니다. 원문 보기.

Wazuh MCP — AI-Powered Security Operations

Connect Wazuh to Claude AI via the Model Context Protocol (MCP), enabling natural-language security operations directly inside Claude Desktop.

87 tools across 21 domain modules — alerts, vulnerabilities, FIM, compliance, MITRE ATT&CK, threat hunting, active response, fleet inventory, SCA, CDB lists, rules, threat intel, incidents, reporting, notifications, onboarding, cluster health, archive search, and alert suppression.

Quick Start — Docker
Quick Start — Local (systemd)
Connect Claude Desktop
Environment Variables
Tool Reference
MCP Prompts
Architecture
Optional Integrations
Security Considerations
Common Issues

Quick Start — Docker

This is the recommended deployment method. The container bundles all dependencies and exposes the MCP server on port 8000.

1. Clone the repository

git clone https://github.com/adi5353/wazuh-mcp.git
cd wazuh-mcp

2. Create your environment file

cp env.example .env
nano .env

Fill in at minimum:

WAZUH_HOST=https://your-wazuh-manager:55000
WAZUH_USER=wazuh-mcp
WAZUH_PASS=YourPassword

WAZUH_INDEXER_HOST=https://your-wazuh-indexer:9200
WAZUH_INDEXER_USER=wazuh-readonly
WAZUH_INDEXER_PASS=YourPassword

WAZUH_VERIFY_SSL=false
WAZUH_MCP_TRANSPORT=http
WAZUH_MCP_HOST=0.0.0.0
WAZUH_MCP_PORT=8000

3. Start the container

docker compose up -d

4. Verify it’s running

docker compose ps
curl -si http://localhost:8000/sse | head -3
# Expected: HTTP/1.1 200 OK

View logs:

docker compose logs -f wazuh-mcp

Stop and restart:

docker compose down
docker compose up -d

Quick Start — Local (systemd)

Use this if you want to run directly on the Wazuh server without Docker.

1. Clone and install

git clone https://github.com/adi5353/wazuh-mcp.git
cd wazuh-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -e .

2. Configure

cp env.example .env
nano .env   # fill in WAZUH_HOST, WAZUH_USER, WAZUH_PASS, indexer credentials

3. Run as a systemd service

sudo tee /etc/systemd/system/wazuh-mcp.service << 'EOF'
[Unit]
Description=Wazuh MCP Server
After=network.target

[Service]
Type=simple
User=vagrant
WorkingDirectory=/home/vagrant/wazuh-mcp
EnvironmentFile=/home/vagrant/wazuh-mcp/.env
ExecStart=/home/vagrant/wazuh-mcp/.venv/bin/python -m wazuh_mcp
Restart=always
RestartSec=5
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable --now wazuh-mcp
sudo systemctl status wazuh-mcp

Verify:

ss -tlnp | grep 8000   # must show 0.0.0.0:8000

GitHub에서 전체 README 보기

설치

This server does not publish a one-line install command.

Open the repository installation guide MCP 초보자라면? mcpskill.org 가이드부터 시작하세요 →

설정

{
  "mcpServers": {
    "wazuh": {
      "command": "mcp-remote",
      "args": [
        "http://YOUR_SERVER_IP:8000/sse",
        "--allow-http"
      ]
    }
  }
}