Wazuh Autopilot is a self-hosted platform that works your Wazuh alerts with a swarm of Strands agents. They reach Wazuh only through the Wazuh MCP Server (v4.3.0, 55 tools). Alerts become incidents. Agents triage, correlate, investigate, enrich and plan the response, and every containment step goes through an autonomy policy you control, from "observe only" to "fully autonomous for low-risk actions". Everything runs in one container plus Postgres and ships with a web console.

⚡ Minutes, not hours  ·  🤖 13 agents / 37 skills  ·  🧭 NIST · MITRE · CIS · ISO · PCI  ·  ✅ Policy-gated response  ·  🔭 Full tracing  ·  🔒 Air-gap ready

Quick start

git clone https://github.com/gensecaihq/Wazuh-Autopilot.git && cd Wazuh-Autopilot
docker compose -f docker-compose.yml -f docker-compose.demo.yml up -d --build
open http://localhost:8480     # admin@autopilot.local / Autopilot!2026

The demo runs against a simulated Wazuh fleet (mock-wazuh/: same tools and schemas as the real MCP server, live alerts, two planted compromises) and a scripted demo model, so it needs neither Wazuh nor an LLM key. Tool calls, policy decisions, approvals, execution and verification are all real. To see real reasoning, pick a model in Settings → Models.

For production, cp .env.example .env, point it at your Wazuh MCP Server and model provider, and run docker compose up -d. The first visit opens the setup wizard. See docs/QUICKSTART.md and docs/DEPLOYMENT.md.

Before enabling active response: the MCP key needs wazuh:write scope, and isolate_host, kill_process and quarantine_file rely on active-response scripts that don't ship with Wazuh, so deploy them on your agents first (details).

Upgrading from 1.x: 3.0 replaces the Node Runtime Service and the

... View full README on GitHub