Wazuh MCP Server

Tools · 37

• get_wazuh_alerts Query, filter, search, and analyze alert data via Elasticsearch
• get_wazuh_alert_summary Query, filter, search, and analyze alert data via Elasticsearch
• analyze_alert_patterns Query, filter, search, and analyze alert data via Elasticsearch
• search_security_events Query, filter, search, and analyze alert data via Elasticsearch
• get_wazuh_agents Monitor agent status, running processes, open ports, and configs
• get_wazuh_running_agents Monitor agent status, running processes, open ports, and configs
• check_agent_health Monitor agent status, running processes, open ports, and configs
• get_agent_processes Monitor agent status, running processes, open ports, and configs
• get_agent_ports Monitor agent status, running processes, open ports, and configs
• get_agent_configuration Monitor agent status, running processes, open ports, and configs
• get_wazuh_vulnerabilities Query CVEs by severity, agent, and package
• get_critical_vulnerabilities Query CVEs by severity, agent, and package
• vulnerability_summary Query CVEs by severity, agent, and package
• analyze_security_threat Threat analysis, IOC lookup, risk scoring, compliance checks
• check_ioc_reputation Threat analysis, IOC lookup, risk scoring, compliance checks
• perform_risk_assessment Threat analysis, IOC lookup, risk scoring, compliance checks
• get_top_security_threats Threat analysis, IOC lookup, risk scoring, compliance checks
• generate_security_report Threat analysis, IOC lookup, risk scoring, compliance checks
• run_compliance_check Threat analysis, IOC lookup, risk scoring, compliance checks
• get_wazuh_statistics Cluster health, rules, manager logs, stats
• get_wazuh_cluster_health Cluster health, rules, manager logs, stats
• get_wazuh_rules_summary Cluster health, rules, manager logs, stats
• search_wazuh_manager_logs Cluster health, rules, manager logs, stats
• wazuh_block_ip Block IPs, isolate hosts, kill processes, quarantine files
• wazuh_isolate_host Block IPs, isolate hosts, kill processes, quarantine files
• wazuh_kill_process Block IPs, isolate hosts, kill processes, quarantine files
• wazuh_disable_user Block IPs, isolate hosts, kill processes, quarantine files
• wazuh_quarantine_file Block IPs, isolate hosts, kill processes, quarantine files
• wazuh_check_blocked_ip Verify active response actions took effect
• wazuh_check_agent_isolation Verify active response actions took effect
• wazuh_check_process Verify active response actions took effect
• wazuh_check_user_status Verify active response actions took effect
• wazuh_unisolate_host Undo active response actions
• wazuh_enable_user Undo active response actions
• wazuh_restore_file Undo active response actions
• wazuh_firewall_allow Undo active response actions
• wazuh_host_allow Undo active response actions