Wazuh SIEM tools for alert triage, threat hunting, vulnerability management, compliance checks and active response.
Setup
Choose your client, copy the config, then fill in any required environment variables.
claude mcp add wazuh -- docker compose up -d~/.codex/config.toml
[mcp_servers.wazuh]
command = "docker"
args = ["compose", "up", "-d"]
# codex mcp add wazuh -- docker compose up -d~/.cursor/mcp.json
{
"mcpServers": {
"wazuh": {
"command": "docker",
"args": [
"compose",
"up",
"-d"
]
}
}
}.vscode/mcp.json
{
"servers": {
"wazuh": {
"type": "stdio",
"command": "docker",
"args": [
"compose",
"up",
"-d"
]
}
}
}~/.gemini/settings.json
{
"mcpServers": {
"wazuh": {
"command": "docker",
"args": [
"compose",
"up",
"-d"
]
}
}
}claude_desktop_config.json
{
"mcpServers": {
"wazuh": {
"command": "docker",
"args": [
"compose",
"up",
"-d"
]
}
}
}.trae/mcp.json
{
"mcpServers": {
"wazuh": {
"command": "docker",
"args": [
"compose",
"up",
"-d"
]
}
}
}