Wazuh-MCP-Server

概述

Wazuh MCP服务器提供AI驱动的安全操作功能，允许用户通过自然语言查询Wazuh SIEM系统。它提供48个安全工具，使用户能够通过对话查询警报、狩猎威胁、检查漏洞并在Wazuh部署中触发主动响应。该服务器支持云端和本地LLM，具有强大的安全功能，包括基于角色的访问控制(RBAC)、审计日志、输入验证和速率限制。该产品已投入生产，文档全面，并有活跃的开发团队维护。

试试问 AI

装完之后，这里有 5 个你可以让 AI 做的事：

• get_wazuh_alerts

  Query and retrieve Wazuh alerts with filtering options

  试试:Show me critical alerts from the last hour试试:Get all alerts for agent-007试试:Find alerts with rule ID 5712
• get_wazuh_alert_summary

  Get a summary of alert statistics and trends

  试试:Give me a summary of today's alerts试试:Show me alert trends for the past 24 hours试试:Count alerts by severity level
• analyze_alert_patterns

  Analyze patterns and correlations in security alerts

  试试:Analyze patterns in brute force attacks试试:Find recurring alert patterns across agents试试:Correlate alerts from the same source IP
• get_wazuh_agents

  List all registered Wazuh agents

  试试:Show me all registered agents试试:List agents with OS type Linux试试:Count agents by status
• get_wazuh_vulnerabilities

  Query vulnerability data from Wazuh

  试试:Show me all critical vulnerabilities试试:Find vulnerabilities on agent-001试试:List vulnerabilities by CVE ID
• analyze_security_threat

  Analyze potential security threats and provide assessments

  试试:Analyze this suspicious login pattern试试:Assess the threat level of this alert试试:Determine if this activity is malicious
• wazuh_block_ip

  Block an IP address across Wazuh agents

  试试:Block the IP address 10.0.1.45试试:Block all incoming connections from this source试试:Prevent further access from this malicious IP
• wazuh_isolate_host

  Isolate a compromised host from the network

  试试:Isolate agent-007 from the network试试:Quarantine this compromised host试试:Disconnect the suspicious agent
• generate_security_report

  Generate a comprehensive security report

  试试:Generate a security report for this week试试:Create a threat intelligence summary试试:Prepare an incident response report
• run_compliance_check

  Run compliance checks against security standards

  试试:Check compliance with CIS benchmarks试试:Run a HIPAA compliance scan试试:Verify NIST control adherence
• wazuh_check_blocked_ip

  Verify if an IP is currently blocked

  试试:Check if 10.0.1.45 is still blocked试试:Verify the status of this blocked IP试试:Confirm if the isolation is active
• wazuh_unisolate_host

  Remove isolation from a previously isolated host

  试试:Restore network access to agent-007试试:Un-isolate this compromised host试试:Remove the quarantine from the agent

可对比工具

安装

git clone https://github.com/gensecaihq/Wazuh-MCP-Server.git
cd Wazuh-MCP-Server
cp .env.example .env
# 编辑 .env 文件，填入你的 Wazuh 凭据
docker compose up -d

FAQ

支持哪些 Wazuh 版本？

此 MCP 服务器支持 Wazuh 4.8.0 至 4.14.4 版本。

我可以将其与本地 LLM 一起使用吗？

是的，它可以通过 Ollama、Open WebUI 或 mcphost 与本地 LLM 一起使用，且数据不会离开您的网络。

Wazuh-MCP-Server 对比