一款基于Rust的服务器，旨在弥合Wazuh安全信息与事件管理（SIEM）系统与需要上下文安全数据的应用之间的差距，专为使用模型上下文协议（MCP）的Claude桌面集成量身定制。

概述

现代人工智能助手如Claude可以显著受益于用户安全环境的实时上下文。Wazuh MCP服务器通过自然语言交互提供对Wazuh SIEM数据的全面访问，弥合了这一差距。

该服务器将复杂的 Wazuh API 响应转换为兼容 MCP 的格式，使 AI 助手能够访问：

• 来自Wazuh索引器的安全警报与事件，用于威胁检测和事件响应
• 代理管理与监控，包括健康状态、系统进程和网络端口
• 漏洞评估 风险管理和补丁优先级数据
• 安全规则与配置用于检测优化和合规验证
• 系统统计与性能用于运营监控和审计追踪的指标

Wazuh MCP Server - Talk to your SIEM

A Rust-based server designed to bridge the gap between a Wazuh Security Information and Event Management (SIEM) system and applications requiring contextual security data, specifically tailored for the Claude Desktop Integration using the Model Context Protocol (MCP).

Overview

Modern AI assistants like Claude can benefit significantly from real-time context about the user’s security environment. The Wazuh MCP Server bridges this gap by providing comprehensive access to Wazuh SIEM data through natural language interactions.

This server transforms complex Wazuh API responses into MCP-compatible format, enabling AI assistants to access:

• Security Alerts & Events from the Wazuh Indexer for threat detection and incident response
• Agent Management & Monitoring including health status, system processes, and network ports
• Vulnerability Assessment data for risk management and patch prioritization
• Security Rules & Configuration for detection optimization and compliance validation
• System Statistics & Performance metrics for operational monitoring and audit trails
• Log Analysis & Forensics capabilities for incident investigation and compliance reporting
• Cluster Health & Management for infrastructure reliability and availability requirements
• Compliance Monitoring & Gap Analysis for regulatory frameworks like PCI-DSS, HIPAA, SOX, and GDPR

Rather than requiring manual API calls or complex queries, security teams can now ask natural language questions like “Show me critical vulnerabilities on web servers,” “What processes are running on agent 001?” or “Are we meeting PCI-DSS logging requirements?” and receive structured, actionable data from their Wazuh deployment.

This approach is particularly valuable for compliance teams who need to quickly assess security posture, identify gaps in monitoring coverage, validate rule effectiveness, and generate evidence for audit requirements across distributed infrastructure.

Example Use Cases

The Wazuh MCP Server provides direct access to Wazuh security data through natural language interactions, enabling several practical use cases:

Security Alert Analysis

• Alert Triage and Investigation: Query recent security alerts with get_wazuh_alert_summary to quickly identify and prioritize threats requiring immediate attention.
• Alert Pattern Recognition: Analyze alert trends and patterns to identify recurring security issues or potential attack campaigns.

Vulnerability Management

• Agent Vulnerability Assessment: Use get_wazuh_vulnerability_summary and get_wazuh_critical_vulnerabilities to assess security posture of specific agents and prioritize patching efforts.
• Risk-Based Vulnerability Prioritization: Correlate vulnerability data with agent criticality and exposure to focus remediation efforts.

System Monitoring and Forensics