MCP server exposing Wazuh SIEM (manager + indexer) operations to AI clients, with false-positive rule-tuning tooling and an Atomic Red Team integration layer.
Simoon896/ai-detection-engineering-platform
Skill Claude CodeCodexCursor
Safely execute Atomic Red Team tests on the allowlisted Windows VM via atomic-redteam MCP only, with per-phase user approval, ART-only tests, mandatory cleanup, and handoff to Wazuh detection engineers. Use when detonating ART tests, running runatomic, red team validation, or detection coverage testing.
Simoon896/ai-detection-engineering-platform
Skill Claude CodeCodexCursor
Correlate Atomic Red Team ledger runs with Wazuh alerts, tune detections safely, and update coverage after ART handoff. Use when analyzing ART detonation results, searching alerts for windowsTest, or closing the red team to detection engineering loop.