mcp-server-wazuh

概述

Wazuh MCP Server 连接 Wazuh SIEM 系统和 Claude 等 AI 助手，通过自然语言交互提供实时安全上下文。它将复杂的 Wazuh API 响应转换为 MCP 兼容格式，使 AI 能访问安全警报、代理管理、漏洞评估、合规监控和日志分析数据。

试试问 AI

装完之后，这里有 5 个你可以让 AI 做的事：

• get_wazuh_alert_summary

  Retrieve summary of recent security alerts for threat detection and incident response

  试试:Show me recent security alerts试试:Get a summary of high-priority alerts
• get_wazuh_vulnerability_summary

  Get overview of vulnerability assessment data across agents

  试试:Show me all vulnerabilities on our agents试试:Get a vulnerability summary for server agents
• get_wazuh_critical_vulnerabilities

  Identify critical vulnerabilities requiring immediate patching

  试试:Show me critical vulnerabilities试试:List vulnerabilities with CVSS score above 9
• get_wazuh_agent_processes

  Monitor running processes on specific agents

  试试:What processes are running on agent 001?试试:Show processes on the database server
• get_wazuh_agent_ports

  Check open ports and network services on agents

  试试:Show open ports on web server agents试试:Check for unusual network connections
• get_wazuh_running_agents

  Monitor agent status and connectivity

  试试:Which agents are currently online?试试:Show health status of all agents
• get_wazuh_rules_summary

  Review security detection rules and their effectiveness

  试试:Show me all active security rules试试:Check rules that triggered alerts today
• get_wazuh_weekly_stats

  Retrieve weekly system performance and statistics

  试试:Show me weekly system statistics试试:Get performance metrics for the last week
• get_wazuh_cluster_health

  Monitor Wazuh cluster status and node health

  试试:Check cluster health status试试:Show node status in the Wazuh cluster
• search_wazuh_manager_logs

  Search and analyze manager logs for incident investigation

  试试:Search for authentication failures in logs试试:Find error messages from last night
• get_wazuh_manager_error_logs

  Retrieve error logs from the Wazuh Manager

  试试:Show me recent manager error logs试试:Check for critical errors in the system
• get_wazuh_remoted_stats

  Get statistics for the Wazuh remote collector service

  试试:Show remoted service statistics试试:Check performance of the collector service

可对比工具

安装

docker pull ghcr.io/gbrigandi/mcp-server-wazuh:latest

git clone https://github.com/gbrigandi/mcp-server-wazuh.git
cd mcp-server-wazuh
cargo build --release

{
  "mcpServers": {
    "wazuh": {
      "command": "/path/to/mcp-server-wazuh",
      "args": [],
      "env": {
        "WAZUH_API_HOST": "your_wazuh_manager_api_host",
        "WAZUH_API_PORT": "55000",
        "WAZUH_API_USERNAME": "your_wazuh_api_user",
        "WAZUH_API_PASSWORD": "your_wazuh_api_password",
        "WAZUH_INDEXER_HOST": "your_wazuh_indexer_host",
        "WAZUH_INDEXER_PORT": "9200",
        "WAZUH_INDEXER_USERNAME": "your_wazuh_indexer_user",
        "WAZUH_INDEXER_PASSWORD": "your_wazuh_indexer_password",
        "WAZUH_VERIFY_SSL": "false",
        "WAZUH_TEST_PROTOCOL": "https",
        "RUST_LOG": "info"
      }
    }
  }
}

FAQ

需要什么版本的 Wazuh？

推荐使用 Wazuh v4.12 版本，需要启用 API 并可访问。

除了 Claude 之外，我能否将其与其他 MCP 兼容客户端一起使用？

是的，此服务器可与任何 MCP 兼容的 LLM 客户端一起使用，但配置示例是为 Claude Desktop 提供的。

mcp-server-wazuh 对比