Wazuh-Autopilot
by gensecaihq
Agentic SOC: 13-agent swarm for Wazuh with governance, audit, and evals
Summary
Implements an agentic SOC that triages, investigates, and plans responses using a 13-agent swarm built on Strands Agents. Orchestrates 37 Wazuh-verified skills through a Wazuh MCP server with policy-gated autonomy, RBAC, approvals, auditing, tracing and built-in evaluations. Packs the full stack into Docker and supports multiple LLM backends (Bedrock, Anthropic, NVIDIA, vLLM, LiteLLM, Ollama) for air-gapped or cloud deployments. This design aligns with governance patterns like the Sub-Agent Delegation Pattern and the Agent Registry Pattern to organize and validate agent roles and responsibilities.
Key Benefits
When to Use
SOC teams and security engineers who want production-ready multi-agent automation for detection, investigation, and policy-gated response workflows. For interoperability and standardized communication, consider the Model Context Protocol (MCP) to align agent actions with shared context.
Applications
- Automating triage and investigation of Wazuh alerts with human-in-the-loop approvals
- Enforcing RBAC and policy gates while delegating response actions to specialized agents
- Collecting audit trails, traces, and evaluation data to build agent reputation and post-incident analysis