AI-assisted incident response with Wazuh

Security teams lose most of their incident-response time to manual triage: reading raw SIEM alerts, looking up context and deciding on a response. The question was whether an AI agent with structured access to Wazuh could shorten that loop without hiding what it does.

Lead author of the paper with Ruslan Damindarov. I built the experiment environment, the attack and benign-activity scenarios, the alert collection and the evaluation scripts.

• Alert querying and summarization from the Wazuh Indexer through MCP tools
• Enrichment of alerts with agent, rule and threat-intelligence context
• Incident reports generated from the enriched alert set
• Active-response actions triggered from the assistant

• Built on the open-source Wazuh MCP server (credited upstream) instead of a custom API layer, and kept research code in a separate folder of the fork.
• Ran 18 attack simulations and six legitimate-activity scenarios on AWS so the evaluation measured false positives as well as detections.
• Collected and stored raw alerts before computing metrics so every number in the paper can be recomputed from saved records.

• Mean time to respond fell from 804 to 15.2 minutes (98.1%) in the controlled evaluation.
• 87.5% precision across the evaluated scenarios.
• Published at the IEEE Silicon Valley Cybersecurity Conference (SVCC) 2026.

• Wazuh SIEM
• MCP
• Python
• AWS
• MITRE ATT&CK

Results come from a controlled lab environment with scripted scenarios, not a production SOC. Scenario filenames describe intended activity; whether an alert is a false positive still depends on what happened in each run.