gensecaihq/Wazuh-Openclaw-Autopilot

Description and use

**Brief Summary (2‑3 sentences)**
The *Wazuh‑Openclaw‑Autopilot* project adds an autonomous SOC layer on top of Wazuh by leveraging OpenClaw agents and the Model‑Context‑Protocol (MCP). It automatically triages alerts, correlates incidents, and builds response playbooks that are presented for human‑in‑the‑loop approval, while also exporting evidence packs, Prometheus metrics, and Slack notifications.

**Value**

• **AI‑augmented security operations** – By connecting AI assistants to Wazuh through a standardized MCP interface, the platform can ingest raw alerts, run ML‑based triage, and suggest concrete remediation steps, dramatically cutting analyst fatigue and mean‑time‑to‑response.
• **Standardised integration point** – MCP serves as a vendor‑agnostic contract, making it easy to swap or add new AI agents, tooling, or data sources without rewriting custom glue code.
• **Observability & collaboration** – Built‑in Prometheus exporters and Slack hooks give teams real‑time visibility into automation health and enable rapid incident communication.

**Practical Adoption Path**

1. **Prototype** – Clone the repo, spin up the provided Docker compose stack (Wazuh, OpenClaw, MCP server) and run the sample JavaScript agent to verify alert ingestion and auto‑triage on a test environment.
2. **Integrate** – Replace the sample agent with your own AI model or LLM endpoint via the MCP SDK, map your organization’s alert taxonomy, and configure Slack/Prometheus endpoints.
3. **Human‑in‑the‑loop rollout** – Enable the approval UI for response plans, pilot with a small SOC team, and iterate on correlation rules and evidence‑pack templates.
4. **Scale** – Deploy the stack on Kubernetes, add HA for the MCP server, and externalise secrets (e.g., Vault) before moving to production.

**Production Readiness**

• **Maturity**: Medium. The codebase is recent (last update 2026‑06‑23) and functional for prototypes, but it still requires thorough dependency vetting, security review of the MCP server, and possibly adding persistence/backup for evidence packs.
• **Signals**: 35 GitHub stars, 13 forks, primary language JavaScript, and clear API/CLI exposure indicate a usable foundation, though the community is small.
• **Risks**: No critical metadata issues yet, but the license, long‑term maintainer commitment, and the security posture of the MCP server need final confirmation before a production deployment.

Overall, *Wazuh‑Openclaw‑Autopilot* offers a compelling way to bring AI‑driven automation into a Wazuh‑based SOC, with a clear path from sandbox testing to production once the outstanding governance and hardening steps are addressed.

Use in a workflow

gensecaihq/Wazuh-Openclaw-Autopilot helps connect AI assistants to real tools and data through a standard protocol.

• connect AI agents to tools
• ship Model Context Protocol servers
• standardize integrations

Limitations and review notes

Medium: useful for prototypes or internal workflows, with dependency and maintenance checks before production.