❯ git clone https://github.com/gensecaihq/Wazuh-Autopilot.git ▌

Wazuh Autopilot: An agentic SOC for Wazuh: a 13-agent AI swarm with humans in control

View on GitHub62 stars15 forksPython · MIT licence · by Aloke Majumder

Wazuh Autopilot is a self-hosted agentic SOC for Wazuh. A swarm of 13 AI agents, built on Strands Agents, works your Wazuh alerts: it turns them into incidents, then triages, correlates, investigates, enriches and plans the response.

Humans stay in control. Agents never receive state-changing Wazuh tools; every containment step passes an autonomy policy and, where required, a human approval, and the platform verifies and can roll back every action. Agents reach Wazuh only through the Wazuh MCP Server.

What Wazuh Autopilot Does

13-agent swarm

SOC Commander, Tier 1 to 3 analysts, CTI analyst, threat hunter, vulnerability manager, IR lead, SecOps and detection engineers, GRC analyst, Wazuh platform engineer and SOC manager.

37 skills and IR playbooks

Wazuh-specific skills plus incident-response playbooks for brute force, lateral movement, privilege escalation, ransomware, suspicious PowerShell, data exfiltration and vulnerability spikes.

Policy-gated autonomy

Four levels (observe, recommend, supervised, autonomous) with confidence floors, hourly budgets, protected targets, a two-person rule and business-hours limits. Critical actions always need a human.

Standards-mapped

NIST CSF 2.0, SP 800-61r3, MITRE ATT&CK and D3FEND, CIS v8.1, ISO/IEC 27001:2022, PCI DSS v4.0.1 and OWASP LLM Top 10.

Any model, including air-gapped

Amazon Bedrock, Anthropic, OpenAI-compatible APIs, NVIDIA NIM, vLLM, LiteLLM or local Ollama, with per-agent overrides.

Operable in production

Web console, RBAC with five roles, audit log, OpenTelemetry tracing, Prometheus metrics and evaluation suites, all in one Docker stack.

How It Works

01Wazuh alerts arrive through the Wazuh MCP Server (poll or webhook) and become incidents.
02The agent swarm triages, correlates, investigates, adds threat intelligence and proposes response actions.
03Proposed actions go through the autonomy policy and the human approvals queue; approved actions are executed, verified, audited and can be rolled back.

Quick Start

git clone https://github.com/gensecaihq/Wazuh-Autopilot.git && cd Wazuh-Autopilot
docker compose -f docker-compose.yml -f docker-compose.demo.yml up -d --build

The demo runs against a simulated Wazuh fleet and a scripted model, so it needs neither Wazuh nor an LLM key. See the README for production setup.

Full setup and configuration are in the README on GitHub.

Who It's For

SOC teams drowning in Wazuh alerts
MSSPs looking to scale triage without losing human oversight
Security leaders evaluating agentic AI for security operations
Teams that need AI automation on-premises or air-gapped

Wazuh Autopilot: FAQs

❯

What is Wazuh Autopilot?

An open-source, self-hosted agentic SOC for Wazuh. A 13-agent AI swarm triages, investigates and plans the response to Wazuh alerts, while an autonomy policy and human approvals keep people in control.

❯

Is Wazuh Autopilot fully autonomous?

Only as far as you allow. It has four autonomy levels (observe, recommend, supervised, autonomous) and per-action rules. Critical actions always need a human, and agents never hold state-changing Wazuh tools themselves.

❯

Which AI models does it support?

Amazon Bedrock, Anthropic, OpenAI-compatible APIs, NVIDIA NIM, vLLM, LiteLLM and local Ollama, so it can run fully air-gapped.

❯

Can I try it without a Wazuh deployment?

Yes. The demo stack runs against a simulated Wazuh fleet with live alerts and a scripted model, so it needs neither Wazuh nor an LLM API key.

❯

How is it related to the Wazuh MCP Server?

Agents reach Wazuh only through the Wazuh MCP Server, which provides the tool layer, scopes and verification. Wazuh Autopilot is the agent platform on top.

❯

Is Wazuh Autopilot free?

Yes, it is open source under the MIT licence. For help designing an agentic SOC around it, see consulting or the Agentic SOC lab in training.

Need help putting it into production?

I built and maintain Wazuh Autopilot. If you want help deploying it, building an AI-assisted SOC around it, or training your team, see AI & security consulting and hands-on training, or get in touch.