Wazuh-MCP-Server

Surface AI/LLM-driven reconnaissance and scanning against your perimeter. Aggregates Wazuh web-accesslog alerts whose raw log line (``full_log``) contains a known AI-agent user-agent (GPTBot, ClaudeBot, ChatGPT-User, PerplexityBot, etc.) or a suspicious custom agent string (ai-scanner, autogpt, lang…

Analyze rule-to-rule transitions to reconstruct attack kill-chain progression.

Detect C2 beaconing patterns via inter-arrival time analysis. Fetches ``@timestamp`` for all alerts from a given source IP, computes inter-arrival gaps, and calculates the coefficient of variation (CV = σ/μ). A low CV with consistent intervals is the statistical signature of periodic beaconing — a h…

Compare alert profiles of two source IP side-by-side. Fetches alert counts, top rules, max severity, MITRE tactics, and beacon scores for both IPs and returns a structured comparison with a verdict on which IP is more suspicious. Saves the LLM from orchestrating 4+ sequential calls to analyze two IP…

Generate a geo/domain/rule-filtered threat intelligence report in one call. Combines alert aggregation, IP extraction, and multi-source threat intel enrichment into a single structured report. Replace 8-12 sequential LLM tool calls with one.

Check file hash reputation via VirusTotal. Args: params.hash: File hash (MD5/SHA1/SHA256) params.response_format: 'markdown' or 'json'

Check domain reputation via VirusTotal. Args: params.domain: Domain name params.response_format: 'markdown' or 'json'

Query Argus Threat Intelligence (TangerangKota-CSIRT) aggregating 7 sources. Renders every provider the response contains, with no hardcoded provider or field names, so a changed response structure still renders instead of showing blanks. Args: params.ip: Public IP to query params.response_format: '…

Query Netra Threat Intelligence for IP analysis. Args: params.ip: Public IP to analyze params.response_format: 'markdown' or 'json' params.bypass_redaction: When true, skip PII/credential redaction for audit investigations.

Check if an IP is currently blocked by Sangfor firewall.

List IP blocked by Sangfor firewall, optionally filtered by timestamp and/or attacker IP/IoC. Sends a POST to the Sangfor /blocklist endpoint (SANGFOR_BLOCKLIST_URL already includes the /blocklist path) with a JSON body {date_start, date_end, limit, offset, ip}. The `ip` key is OMITTED from the body…

Query multiple threat intel sources and return a unified confidence score. Aggregates CrowdSec + ThreatFox + AbuseIPDB into a single weighted verdict (0.0–1.0) eliminating the need for 3+ sequential LLM tool calls per IP.

Summarize Wazuh alerts for a source IP into a compact threat digest.

Generate a comprehensive threat card for a source IP. Collapses alert summarization, attack chain analysis, MITRE ATT&CK mapping, and threat intelligence (CrowdSec + GreyNoise) into a single structured report. Designed as the one-stop triage tool the LLM can understand the full threat context in one…

Look up internal asset context for a hostname/subdomain.

Analyze the attacker relationship graph - campaign clusters, hubs, bridges.

Suggest the next investigation step for an IOC, driven by the attack graph.

Detect campaign evolution: new clusters and growth in existing clusters.

Compute statistical baselines for alert volume, unique IPs, or severity.

Detect scheduled attack patterns via day×hour heatmap analysis.

Detect alert-volume anomalies: current window vs a historical baseline via Z-score.

Create a new investigation case (durable incident record).

Attach IOC to an existing case. **Worked Examples** 1. ``blueteam_case_add_iocs(case_id="case_abc123", iocs=["evil.com", "d41d8cd98f00..."])``

Record an investigation verdict against a srcip within a case.

Fetch a case by ID, with all its IOCs and verdicts.

List all cases (most recent first).

Zero-doc statistical analysis of Wazuh alerts across the full index.

Evaluate 3-Sum APT detection across 3 Wazuh alert categories.

Run a comprehensive IP investigation - alert profile, timeline, and geo. Combines three indexer queries in parallel: 1. Alert count + top rules (like alert summarization) 2. Hourly timeline (for pattern/beacon detection) 3. Geo distribution (country-level attack origin)

Fetch a CVE record from NVD: description, CVSS, severity, references.

Return EPSS scores for one or more CVE IDs (exploitation probability).

Check if a CVE is in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Search for public proof-of-concept exploits for a CVE (GitHub + Nuclei).

Compute a composite 0-100 risk score for a CVE (CVSS + EPSS + KEV + PoC).

Triage a CVE with the CISA SSVC Deployer tree (Act / Attend / Track* / Track).

Scan a dependency manifest against OSV.dev and return vulnerable packages.

Convert a SOC PDF (IR playbook, vendor advisory, scanned report) to markdown/JSON/HTML/chunks using the Marker engine (surya layout + OCR models). SOC IR workflow: drop a playbook or advisory PDF on the server under an allowed path, then convert it to markdown for LLM analysis or to JSON for structu…

Generate typosquatting/phishing lookalikes of a domain. Produces the most likely near-miss domains an attacker would register against your org (omission, swap, repetition, homoglyph, hyphenation, TLD swap). Feed the top candidates into `blueteam_whois_lookup` / `blueteam_crtsh_lookup` to detect acti…

Execute a raw OpenSearch DSL aggregation query against the Wazuh Indexer.

List all active fail2ban jails and their ban counts.

Get detailed status of a specific fail2ban jail, including all banned IPs.

Unban an IP address from a specific fail2ban jail. DESTRUCTIVE: Modifies security state (removes ban).

Show top attacking countries by alert volume using Wazuh GeoIP data.

Read and optionally filter /var/log/auth.log for SSH, sudo, and PAM events.

Read /var/log/syslog or journalctl for general system events.

Read nginx or Apache access/error logs. Great for spotting web attacks.

Query systemd journal for any service. Useful for services without flat log files.

List all TCP/UDP ports currently listening, with owning process. Equivalent to 'ss -tulpn'. Identifies unexpected services.

List all established TCP connections with remote IPs and local processes. Useful for spotting unexpected outbound connections (beaconing, exfil).

Capture live network traffic using tcpdump. Requires root or CAP_NET_RAW. Read-only for packet inspection; writes pcap files when params.output_file is set. Makes network I/O (openWorldHint).

Compute a cryptographic hash of a file. Use to detect tampering. Pair with blueteam_lookup_hash_virustotal to check for known malware.

Find all SUID/SGID binaries on the system. Unexpected SUID files can indicate privilege escalation backdoors.

Find world-writable files and directories (excluding /proc, /sys, /dev). World-writable files in unexpected places are common persistence mechanisms.

Run a rootkit scanner (rkhunter or chkrootkit) to check for known rootkits.

Run a Lynis system hardening audit. Checks hundreds of security controls and produces prioritized recommendations. Takes 1-2 minutes.

Check for available security updates (Debian/Ubuntu: apt, RHEL: dnf/yum).

Show current firewall rules (iptables/nftables/ufw). Identifies overly permissive rules or missing protections.

Show currently logged-in users, their source IPs, and session times. Useful for detecting unauthorized active sessions.

Show recent login history from /var/log/wtmp. Includes successful and failed logins with source IP and timestamps.

Show all failed login attempts from /var/log/btmp (lastb). High counts from a single IP indicate brute force.

Show recent sudo command usage from auth.log. Identifies privilege escalation abuse.

List all local user accounts with UID, GID, home dir, and shell. Highlights users with UID 0 (root-level) and users with login shells.

List all SSH authorized_keys files across all user home directories. Unexpected keys indicate backdoors or persistence mechanisms.

List all running processes with CPU, memory, PID, and command line. Useful for spotting unexpected processes or cryptominers.

List all system and user cron jobs. Attackers often add cron jobs for persistence. Check for unexpected entries.

Get an overview of system health: uptime, disk, memory, CPU load. Useful baseline before deeper investigation.

Discover Wazuh Indexer field names and types before building queries.

Record an IP investigation verdict in the persistent JSONL history. Appends a timestamped entry to BLUETEAM_INVESTIGATION_HISTORY. This is the only tool that writes investigation state - all other tools (curated reports, threat cards, beacon detection) are read-only.

Count how often a Wazuh rule fired but was later marked false-positive.

Dashboard: unique IPs investigated, verdict breakdown, analyst notes.

Check if an IP was previously investigated and what the verdict was.

List the false-positive knowledge base - IOC the 3-Sum engine auto-suppresses.

Run the full SOC investigation workflow (langgraph) end-to-end. Orchestrates the platform's analyzers as a stateful graph: extract IOCs -> false-positive gate (opt-in) -> threat-intel enrichment -> CVE pipeline (dependency scan + score + SSVC + MITRE) -> 3-Sum correlation -> attack graph -> STIX kil…

Extract structured Indicators of Compromise from raw text.

Query the IOC lifecycle store - discovered IOCs ranked by time-decay recency.

Fingerprint a TLS server (JARM-style) to identify C2/malware infrastructure. Probes the server with multiple TLS configurations and hashes the negotiated cipher + version + certificate. Identical fingerprints indicate the same underlying software - useful for attributing C2 servers. **No API key req…

Convert an office or data file (DOCX, XLSX, PPTX, PDF, HTML, CSV, JSON, XML, Outlook .msg) to Markdown for LLM ingestion using the lightweight MarkItDown engine (pdfminer-based; no torch, no OCR, no network egress).

Show server telemetry per-tool call counts, latency, and guard counters. Surfaces the same data as the `metrics://prometheus` resource in a form the LLM can read directly: top tools by call count, top tools by cumulative latency, and redaction-gate / rate-limit rejections. Use it to find slow or hot…

Look up an IOC in AlienVault OTX (Open Threat Exchange). OTX is the largest open threat intel community. Unlike reputation-only feeds, OTX returns *pulses* - curated IOC collections with malware families, adversaries, industries, and MITRE ATT&CK technique IDs. This provides attribution and campaign…

Look up multiple IOCs against AlienVault OTX concurrently (max 20).

Show the active redaction policy and the configured owned (victim) domains.

Set the runtime owned (victim) domains used by `protect_victim` redaction. Operator action - changes which emails/subdomains are masked. In-memory only: the change lasts until restart; set `BLUETEAM_OWNED_DOMAINS` for a persistent default. **Worked Examples** 1. ``blueteam_set_owned_domains(domains=…

Run an alert-driven hunting + investigation playbook (langgraph supervisor).

Map a natural language security prompt to the most relevant Wazuh MCP tools. Uses BM25 lexical ranking over all registered tool descriptions, with an optional cross-encoder rerank pass (``rerank=True``) for semantic, cross-lingual matching. Breaks the prompt into key terms, scores each against the t…

Rebuild a RAG corpus label from its source of truth and embed it locally. Requires ``BLUETEAM_RAG_ENABLED=true`` and an absolute ``BLUETEAM_RAG_DB``. Requires the ``wazuh:write`` scope on the streamable_http transport (derived automatically from ``readOnlyHint=False``). ``source="cases"`` reads ``ca…

Retrieve analyst knowledge: prior cases, confirmed false positives, IR playbooks. Two stages. Vector recall pulls ``recall_k`` candidates (default 100) from the local SQLite store; the optional cross-encoder rerank re-scores them and keeps ``top_k``. Rerank is rank-based and applies NO score thresho…

Assemble false-positive evidence for one indicator. Recommends; never writes. Deterministic, in this order: 1. The indicator is in the exact-suppression set AND the attacker registry -> ``conflicting_state``. Neither store clears the other, so this tool refuses to pick a winner. 2. The indicator is …

Generate a SOC report deliverable (.docx / .xlsx / .pptx) via officecli.

Semantic search over Wazuh rules using BM25 lexical ranking.

Validate a Sigma rule: YAML + schema always, pySigma parse when installed. Read-only. No network, no filesystem access. Nothing is executed. Wazuh target: none. This tool touches no Wazuh API. Indexer unmapped-field checking happens in blueteam_sigma_rule_generate, which has the alert context.

Generate a Sigma rule draft from a Wazuh alert pattern or analyst text.

Save a validated Sigma rule to the staging directory for human review.

Convert a Sigma rule into an OpenSearch query or Dashboards artifact.

Check if an email appears in known stealer logs (HudsonRock).

Correlate Wazuh findings with the MITRE ATT&CK STIX 2.1 knowledge graph.

Build an ATT&CK kill chain for a source IP from observed alerts + the STIX graph.

Map a CVE to MITRE ATT&CK techniques and the threat groups that use them.

Run a named threat hunting query against Wazuh alert data.

Aggregate threat intelligence from all available providers for one IOC.