loading…
wazuh tool calling capability for investigation using wazuh indexer and wazuh manager
/api/mcp/srv-wazuh-investigationMCP enable + token are only for calling from an external client — the playground below needs neither.
Generate alert statistics grouped by rule ID, severity, or agent over specified time period
{
"type": "object",
"required": [
"group_by",
"time_range"
],
"properties": {
"group_by": {
"enum": [
"rule_id",
"severity",
"agent_id",
"mitre_tactic"
],
"type": "string"
},
"min_count": {
"type": "integer",
"default": 1
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"agent_groups": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Analyze file integrity monitoring events for specific files or directories across agents with change detection and baseline comparison
{
"type": "object",
"required": [
"file_path"
],
"properties": {
"agent_id": {
"type": "string"
},
"file_path": {
"type": "string"
},
"time_range": {
"enum": [
"last_1h",
"last_24h",
"last_7d",
"last_30d"
],
"type": "string"
},
"change_type": {
"enum": [
"added",
"modified",
"deleted",
"all"
],
"type": "string"
},
"include_file_content": {
"type": "boolean",
"default": false
},
"compare_with_baseline": {
"type": "boolean",
"default": true
}
}
}Create investigation case from alerts or manual input with assigned analyst and priority level
{
"type": "object",
"required": [
"title",
"priority"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"title": {
"type": "string"
},
"priority": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"alert_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"assigned_to": {
"type": "string"
},
"description": {
"type": "string"
}
}
}Create a new custom detection rule with conditions, severity level, and alert configuration
{
"type": "object",
"required": [
"rule_id",
"level",
"description"
],
"properties": {
"level": {
"type": "integer",
"maximum": 15,
"minimum": 0
},
"regex": {
"type": "string"
},
"groups": {
"type": "array",
"items": {
"type": "string"
}
},
"if_sid": {
"type": "string"
},
"rule_id": {
"type": "integer",
"minimum": 100000
},
"frequency": {
"type": "integer"
},
"timeframe": {
"type": "integer"
},
"decoded_as": {
"type": "string"
},
"description": {
"type": "string"
},
"same_source_ip": {
"type": "boolean"
}
}
}Create security incident from one or more alerts with severity assignment, analyst assignment, and initial notes
{
"type": "object",
"required": [
"title",
"alert_ids",
"severity"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"title": {
"type": "string"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"alert_ids": {
"type": "array",
"items": {
"type": "string"
},
"minItems": 1
},
"description": {
"type": "string"
},
"assigned_analyst": {
"type": "string"
}
}
}Execute active response command on target agents to contain threats or gather forensic data
{
"type": "object",
"required": [
"command",
"agent_ids",
"justification"
],
"properties": {
"command": {
"enum": [
"isolate_host",
"kill_process",
"block_ip",
"collect_artifacts"
],
"type": "string"
},
"agent_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"parameters": {
"type": "object"
},
"justification": {
"type": "string"
}
}
}Generate comprehensive threat intelligence report for specified time period with IOC analysis
{
"type": "object",
"required": [
"report_type",
"time_range"
],
"properties": {
"end_time": {
"type": "string",
"format": "date-time"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"last_24h",
"last_7d",
"last_30d",
"custom"
],
"type": "string"
},
"report_type": {
"enum": [
"executive",
"technical",
"ioc_summary"
],
"type": "string"
},
"agent_groups": {
"type": "array",
"items": {
"type": "string"
}
},
"severity_threshold": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string",
"default": "medium"
},
"include_mitre_mapping": {
"type": "boolean",
"default": true
}
}
}Get comprehensive agent information including configuration, status, installed packages, and recent activity by agent ID
{
"type": "object",
"required": [
"agent_id"
],
"properties": {
"agent_id": {
"type": "string"
},
"include_packages": {
"type": "boolean",
"default": false
},
"include_processes": {
"type": "boolean",
"default": false
},
"include_syscollector": {
"type": "boolean",
"default": true
}
}
}Retrieve full alert details including raw log data and rule information by alert ID
{
"type": "object",
"required": [
"alert_id"
],
"properties": {
"alert_id": {
"type": "string"
},
"include_raw_log": {
"type": "boolean",
"default": true
}
}
}Retrieve complete rule information including conditions, description, MITRE ATT&CK mappings, and recent trigger statistics
{
"type": "object",
"required": [
"rule_id"
],
"properties": {
"rule_id": {
"type": "string"
},
"time_range_stats": {
"enum": [
"last_24h",
"last_7d",
"last_30d"
],
"type": "string",
"default": "last_24h"
},
"include_statistics": {
"type": "boolean",
"default": true
},
"include_mitre_mapping": {
"type": "boolean",
"default": true
}
}
}Hunt for file integrity monitoring events across specified paths and file operations
{
"type": "object",
"required": [
"file_path"
],
"properties": {
"agent_id": {
"type": "string"
},
"file_path": {
"type": "string"
},
"operation": {
"enum": [
"added",
"modified",
"deleted",
"all"
],
"type": "string",
"default": "all"
},
"recursive": {
"type": "boolean",
"default": false
},
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d"
],
"type": "string"
},
"checksum_changed": {
"type": "boolean"
}
}
}Hunt for indicators of compromise across agents using YARA rules, file hashes, IP addresses, or custom IOCs
{
"type": "object",
"required": [
"ioc_type",
"ioc_value"
],
"properties": {
"ioc_type": {
"enum": [
"hash",
"ip",
"domain",
"yara_rule",
"file_path",
"registry_key"
],
"type": "string"
},
"agent_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"ioc_value": {
"type": "string"
},
"scan_type": {
"enum": [
"realtime",
"on_demand"
],
"type": "string"
},
"time_range": {
"enum": [
"last_1h",
"last_24h",
"last_7d",
"last_30d"
],
"type": "string"
}
}
}Retrieve Security Configuration Assessment results for compliance frameworks like CIS, PCI-DSS
{
"type": "object",
"required": [
"agent_id"
],
"properties": {
"result": {
"enum": [
"passed",
"failed",
"not_applicable",
"all"
],
"type": "string",
"default": "all"
},
"agent_id": {
"type": "string"
},
"check_id": {
"type": "string"
},
"policy_id": {
"type": "string"
},
"compliance_framework": {
"enum": [
"cis",
"pci_dss",
"nist",
"gdpr",
"hipaa"
],
"type": "string"
}
}
}List all active Wazuh agents with their status, version, and last keep-alive timestamp
{
"type": "object",
"required": [],
"properties": {
"group": {
"type": "string"
},
"limit": {
"type": "integer",
"default": 50
},
"status": {
"enum": [
"active",
"disconnected",
"never_connected",
"all"
],
"type": "string",
"default": "active"
},
"platform": {
"enum": [
"windows",
"linux",
"macos",
"all"
],
"type": "string"
}
}
}Assign agents to configuration groups for centralized policy management
{
"type": "object",
"required": [
"agent_id",
"group_name",
"action"
],
"properties": {
"force": {
"type": "boolean",
"default": false
},
"action": {
"enum": [
"add",
"remove",
"set"
],
"type": "string"
},
"agent_id": {
"type": "string"
},
"group_name": {
"type": "string"
}
}
}Search security alerts across agents with filters for rule ID, severity, and time range
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"query": {
"type": "string",
"description": "Lucene query syntax"
},
"rule_id": {
"type": "string"
},
"agent_id": {
"type": "string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d",
"custom"
],
"type": "string"
}
}
}Search vulnerability assessment results across agents with CVE filters and severity scoring
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"cve_id": {
"type": "string"
},
"agent_id": {
"type": "string"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"package_name": {
"type": "string"
},
"fix_available": {
"type": "boolean"
},
"cvss_score_min": {
"type": "number",
"maximum": 10,
"minimum": 0
}
}
}Update investigation case status and add analyst notes or resolution details
{
"type": "object",
"required": [
"case_id",
"status"
],
"properties": {
"notes": {
"type": "string"
},
"status": {
"enum": [
"open",
"in_progress",
"resolved",
"closed",
"false_positive"
],
"type": "string"
},
"case_id": {
"type": "string"
},
"resolution": {
"type": "string"
}
}
}Update incident status, add investigation notes, assign analysts, or close incidents with resolution details
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"notes": {
"type": "string"
},
"status": {
"enum": [
"open",
"in_progress",
"resolved",
"closed",
"false_positive"
],
"type": "string"
},
"resolution": {
"type": "string"
},
"incident_id": {
"type": "string"
},
"assigned_analyst": {
"type": "string"
}
}
}