In the era of AI, I was thinking that is there any way that i can talk with my WAZUH siem instead of clicking dashboards? Just to know what are the top alerts, what are the top vulnerabilities found in a given time period. Turns out, it’s possible. Other than Wazuh you need some tools like claude desktop and mcp server for Wazuh. The MCP server sits in the middle, listens to Claude, talks to Wazuh, and then hands the answer back in plain English. If you want to learn more about Model context protocol (MCP) check out this link.
Here’s how I got it working. (A basic understanding of Wazuh, claude, mcp and docker is required to perform this activity.)
Step 1. What you need first
A Wazuh instance up and running (API and indexer accessible). I’ll skip the Wazuh installation but if you want to know about how to install Wazuh you can check one of my previous article called Threat detection and Response with Wazuh.
Docker Desktop up and running. Our mcp server will run here. For installing docker desktop in windows environment check out this link.
Claude Desktop on the same machine. In my case its a windows-11 PC. Checkout this link for downloading and installing claude desktop in your PC.
Step 2. Grab the Wazuh MCP server
Assume that you have your environment ready. A windows-11 PC where docker desktop and claude desktop is running. So far I found three Wazuh MCP server which are developed by:
1. Gianluca Brigandi (gbrigandi)
2. GenSecAI (gensecaihq)
3. SOCFortress (socfortress)
I’m going to show you the first one which is developed by Gianluca Brigandi (gbrigandi). A big thanks to Gianluca Brigandi for his awesome work.
Run the below command to pull the image.
docker pull ghcr.io/gbrigandi/mcp-server-wazuh:latest
open docker desktop and go to images. You will see the recently downloaded image like below.
Now the image is downloaded and ready to run you just need to create an .env file where you will provide the detail of your Wazuh siem. Create a folder, in my case it is in C:\wazuh-mcp and create the .env file under this directory. You can give any name you like for the folder. Inside the .env file paste the below text. Adjust the modification according to your environment.
WAZUH_API_HOST=<WAZUH-SERVER-IP> WAZUH_API_PORT=55000 WAZUH_API_USERNAME=<API-USER-NAME> WAZUH_API_PASSWORD=<API-User-Password> WAZUH_INDEXER_HOST=<INDEXER-HOST> WAZUH_INDEXER_PORT=9200 WAZUH_INDEXER_USERNAME=<INDEXER-USERNAME> WAZUH_INDEXER_PASSWORD=<INDEXER-PASSWORD> WAZUH_VERIFY_SSL=false WAZUH_TEST_PROTOCOL=https RUST_LOG=info
save and close the .env file.
Step 3: Configure the claude desktop
Open claude desktop and go to File->Settings->Developer tab. Click on Edit config. It will open a folder and you will find a file name claude_desktop_config.json. Open the file and paste the below text.
{
"mcpServers": {
"wazuh": {
"command": "docker",
"args": [
"run", "--rm", "-i",
"--env-file", "C:/wazuh-mcp/.env.txt",
"ghcr.io/gbrigandi/mcp-server-wazuh:latest"
]
}
}
}
Save and close the file. Exit from claude and open it again. Go again to File->Settings->Developer tab. If every thing works well you will see the Wazuh mcp server is running like below. Remember docker engine need to be up and running.
Step 4: Ask away
Its time to talk with Wazuh. Open claude and ask question like “show me the agent status” or “show me the recent alert” or “show me the top 10 vulnerabilities“. You will see claude will start generating your answer with in a few seconds. You can also generate report like short executive summary with graph and charts.
And that’s it. No magic, just a tiny middleman (the MCP server) that makes Wazuh talk in plain English when claude ask. I always feel uncomfortable of sharing data with AI agent like claude. For testing, it is okay to see how it works, but for production make sure you use a read only Wazuh API user and if you are using claude check out their data privacy policy.
About the Author: Imtiaz is working in a financial organization in Bangladesh and having experience in system, network and security administration. Feel free to contact with him on LinkedIn or Twitter.