Autonomous SOC layer for Wazuh using OpenClaw agents with MCP . Auto-triage alerts, correlate incidents, generate response plans with human-in-the-loop approval. Evidence packs, Prometheus metrics, Slack integration.
Stars
24
Forks
7
Watchers
24
Open Issues
5
Overall repository health assessment
No package.json found
This might not be a Node.js project
136
commits
feat: Auto-close executed cases after configurable grace period (fixes #29)
185f7beView on GitHubfix: Resolve agent_id from case entities, count auto_verdict for FP rate (refs #25)
12937f9View on GitHubfix: Add descriptive note for Wazuh 400 errors on active response (refs #25)
4d03f8dView on GitHubfix: block_ip missing agent_id causes Wazuh 400 error (refs #25)
d5ff619View on GitHubfix: Promote investigation classification to case title and auto_verdict (refs #25)
d5c0d5fView on GitHubfix: KPI units are seconds not minutes in reporting agent docs (refs #25)
a829187View on GitHubfix: Case status stuck at approved, findings not promoted, KPI zeros (refs #25)
b6231daView on GitHubfeat: Add reporting agent endpoints with SLA/KPI tracking (fixes #25)
18ce262View on GitHubfix: Harden install script for cross-distro and container compatibility
008aaf6View on GitHubfix: Install script fails on Debian/Ubuntu where sh is dash (fixes #28)
ccef750View on GitHubfeat: Update toolmap and validation for Wazuh MCP Server v4.2.1 compatibility
a33909dView on GitHub