Rust 기반 서버로, Wazuh 보안 정보 및 이벤트 관리(SIEM) 시스템과 컨텍스트 보안 데이터가 필요한 애플리케이션 간의 간극을 메우기 위해 설계되었으며, 모델 컨텍스트 프로토콜(MCP)을 사용하는 Claude 데스크톱 통합에 특별히 맞춰져 있습니다.

개요

Claude와 같은 현대 AI 비서는 사용자의 보안 환경에 대한 실시간 맥락을 통해 큰 혜택을 볼 수 있습니다. Wazuh MCP 서버는 자연어 상호작용을 통해 Wazuh SIEM 데이터에 대한 포괄적인 접근을 제공하여 이 간극을 메웁니다.

이 서버는 복잡한 Wazuh API 응답을 MCP 호환 형식으로 변환하여 AI 비서가 다음을 접근할 수 있도록 합니다:

• 위협 탐지 및 사고 대응을 위한 Wazuh 인덱서의 보안 경고 및 이벤트**
• 에이전트 관리 및 모니터링 건강 상태, 시스템 프로세스, 네트워크 포트 포함
• 위험 관리 및 패치 우선순위 지정을 위한 취약점 평가 데이터
• 탐지 최적화 및 준수 검증을 위한 보안 규칙 및 구성
• 시스템 통계 및 성능 운영 모니터링 및 감사 추적을 위한 지표

Wazuh MCP Server - Talk to your SIEM

A Rust-based server designed to bridge the gap between a Wazuh Security Information and Event Management (SIEM) system and applications requiring contextual security data, specifically tailored for the Claude Desktop Integration using the Model Context Protocol (MCP).

Overview

Modern AI assistants like Claude can benefit significantly from real-time context about the user’s security environment. The Wazuh MCP Server bridges this gap by providing comprehensive access to Wazuh SIEM data through natural language interactions.

This server transforms complex Wazuh API responses into MCP-compatible format, enabling AI assistants to access:

• Security Alerts & Events from the Wazuh Indexer for threat detection and incident response
• Agent Management & Monitoring including health status, system processes, and network ports
• Vulnerability Assessment data for risk management and patch prioritization
• Security Rules & Configuration for detection optimization and compliance validation
• System Statistics & Performance metrics for operational monitoring and audit trails
• Log Analysis & Forensics capabilities for incident investigation and compliance reporting
• Cluster Health & Management for infrastructure reliability and availability requirements
• Compliance Monitoring & Gap Analysis for regulatory frameworks like PCI-DSS, HIPAA, SOX, and GDPR

Rather than requiring manual API calls or complex queries, security teams can now ask natural language questions like “Show me critical vulnerabilities on web servers,” “What processes are running on agent 001?” or “Are we meeting PCI-DSS logging requirements?” and receive structured, actionable data from their Wazuh deployment.

This approach is particularly valuable for compliance teams who need to quickly assess security posture, identify gaps in monitoring coverage, validate rule effectiveness, and generate evidence for audit requirements across distributed infrastructure.

Example Use Cases

The Wazuh MCP Server provides direct access to Wazuh security data through natural language interactions, enabling several practical use cases:

Security Alert Analysis

• Alert Triage and Investigation: Query recent security alerts with get_wazuh_alert_summary to quickly identify and prioritize threats requiring immediate attention.
• Alert Pattern Recognition: Analyze alert trends and patterns to identify recurring security issues or potential attack campaigns.

Vulnerability Management

• Agent Vulnerability Assessment: Use get_wazuh_vulnerability_summary and get_wazuh_critical_vulnerabilities to assess security posture of specific agents and prioritize patching efforts.
• Risk-Based Vulnerability Prioritization: Correlate vulnerability data with agent criticality and exposure to focus remediation efforts.

System Monitoring and Forensics