The AI layer Wazuh was missing.

Claude AI analyzes every alert with full context — asset criticality, user risk, threat intel, behavioral baselines, and playbook guidance. Returns structured verdicts with confidence scores, MITRE mapping, and recommended actions.

The feedback engine tracks which rules produce false positives, where humans override the AI, and what patterns recur. It then proposes Wazuh rule XML modifications — reviewed and deployed through the dashboard.

Ask questions in plain English: “Show me all machines that talked to 10.0.0.50 in the last 24 hours.” The query agent translates to OpenSearch queries, runs them, and synthesizes a human-readable answer.

Every 6 hours, the hunt agent generates hypotheses based on MITRE ATT&CK coverage gaps, builds OpenSearch queries, runs them, and surfaces findings for analyst review. Continuous, not quarterly.

Alerts are automatically grouped into incidents using 4-rule priority logic (IP+rule, user+tactic, host, fallback). Full timeline, MITRE badges, assignment, notes, merge, and Slack/email notifications.

9 response actions (block IP, isolate host, kill process, quarantine file, and more) with verification. Plus integrated vulnerability management — find CVEs, generate fix commands, execute remotely, verify the update landed.

30-day baselines per agent, IP, and user. Z-score anomaly detection flags unusual activity on every alert. Anomaly indicators show up in the triage UI and feed directly into the AI's reasoning.

Overview, Triage, Incidents, Detection, Hunt, Closed Loop, Investigate, Respond, Admin. Charts, filters, expandable details, role-based access. Everything in one embedded UI — no separate frontend to deploy.

4-role RBAC, JWT auth with PBKDF2 hashing (260k iterations), per-endpoint rate limiting, prompt injection defense, XML validation, audit logging, and security headers. Built for real deployments.