The Complete Production SOP: How to Deploy and Run Wazuh SIEM Security Monitoring & XDR in Autonomous AI Agents
Step-by-step SOP to install and run Wazuh SIEM Security Monitoring & XDR in Codex, Claude Code, and Cursor. Includes verified prompts, XML rules, and fixes.
Technical Overview & Architectural Context
Without structured procedural boundaries, autonomous coding agents generating Wazuh SIEM and XDR configurations routinely fail in critical security contexts. Agents frequently generate invalid XML schema definitions for local_rules.xml, assign collision-prone rule IDs (overlapping with Wazuh core rule ID ranges 0-99999), or incorrectly parameterize regex matchers in ossec.conf. Furthermore, agents often overlook multi-homed cluster network topology, hardcode non-routable manager endpoints, and fail to validate authd registration TLS handshakes. Deploying the 'wazuh-siem-endpoint-detection' skill enforces deterministic execution across Codex Desktop, Claude Code, Cursor, and Windsurf. By constraining the agent to strict parameter boundaries (workspace-isolated filesystem writes, zero uninspected shell executions, and rigorous local schema checks), the agent reliably scaffolds Wazuh agent enrollment templates, valid custom decoder XMLs, syscheck File Integrity Monitoring (FIM) directives, and loganalysis pipelines without hallucinating insecure fallback defaults.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Create the local skill manifest directory and inject verified procedural rules into your agent's configuration tree.
Autonomous agent runtimes inspect root directories and designated agent directories (`~/.claude/skills`, `.cursor/skills`, or `.codex/skills`) for YAML frontmatter defining skill trigger patterns. Mount the skill definition directly into your repository or global agent path to ensure the runtime indexes the 'deploy wazuh agent' and 'create custom wazuh rule' triggers.
mkdir -p .agents/skills/wazuh-siem-endpoint-detection && curl -fsSL https://askills.dev/api/skills/wazuh-siem-endpoint-detection/raw -o .agents/skills/wazuh-siem-endpoint-detection/SKILL.md---
name: "wazuh-siem-endpoint-detection"
description: "Deploy enterprise SIEM, endpoint detection, and compliance monitoring with Wazuh."
metadata:
author: "Wazuh"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "deploy wazuh agent"
- "configure wazuh manager"
- "create custom wazuh rule"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---Place the SKILL.md in project root `.agents/skills/` to limit context overhead; global home directory skills consume system prompt tokens across every unrelated repository session.
The skill enforces `shell_exec: false`. The agent must output reproducible deployment manifests, Ansible playbooks, or XML rules for you to review and apply, preventing unauthorized background process execution.
Environment Secrets & Dependency Validation
Configure target manager credentials and environment templates without leaking sensitive enrollment tokens into agent history.
Wazuh agent auto-enrollment requires an authd password or TLS certificates. Provide your agent with non-sensitive variable names using an environment template file (.env.example) and ensure strict .gitignore filtering so production credentials are never ingested by LLM completion providers.
printf "WAZUH_MANAGER='10.0.0.50'\nWAZUH_AGENT_GROUP='production-web'\nWAZUH_REGISTRATION_PASSWORD=''
" > .env.example && git check-ignore -v .env || echo ".env*" >> .gitignore<ossec_config>
<client>
<server>
<address>${WAZUH_MANAGER}</address>
<port>1514</port>
<protocol>tcp</protocol>
</server>
<config-profile>ubuntu, debian</config-profile>
<notify_time>10</notify_time>
<time-reconnect>60</time-reconnect>
<auto_restart>yes</auto_restart>
</client>
</ossec_config>Instruct the agent to reference environment variables via `${VAR}` expansion in templates rather than injecting plaintext tokens or IP addresses into generated XML manifests.
Do not commit `.env.production` files containing real Wazuh authd registration passwords to repositories inspected by remote LLM workers.
Intent Matching & Trigger Invocation
Invoke deterministic rule and configuration generation using exact frontmatter triggers.
Trigger deterministic behavior by employing phrasing that matches the skill's triggers: 'create custom wazuh rule', 'configure wazuh manager', or 'deploy wazuh agent'. When the agent receives these phrases, it references the XML rule standards, rule ID blocks (100000-120000 for user custom rules), and log parsing requirements specified in the skill.
# In Claude Code CLI, Cursor Chat, or Windsurf Cascade:
# Request agent execution using the exact trigger phrase<group name="custom_ssh_bruteforce,sshd,">
<rule id="100002" level="10" frequency="6" timeframe="120">
<if_matched_sid>5710</if_matched_sid>
<same_source_ip />
<description>Custom: Detected consecutive SSH authentication failures from single IP.</description>
<mitre>
<id>T1110.001</id>
</mitre>
<group>authentication_failures,pci_dss_10.2.4,pci_dss_10.2.5,</group>
</rule>
</group>Instruct the agent explicitly to provide MITRE ATT&CK tags (`<mitre><id>...</id></mitre>`) for every custom rule to ensure compliance mappings load properly in Wazuh Indexer dashboards.
Avoid rule IDs below 100000. Core Wazuh rules occupy IDs 1 to 99999, and duplicate IDs will cause the Wazuh analysis daemon (wazuh-analysisd) to crash on service restart.
Verification, Linting & Output Quality Gate
Execute local XML schema validation and linting on the agent deliverables before applying to production servers.
Because the skill sets `shell_exec: false` for security, the developer or local CI test runner must validate the generated rule XML against OSSEC schema standards before publishing or pushing to `/var/ossec/etc/rules/`.
xmllint --noout --valid rules/local_rules.xml || python3 -c "import xml.etree.ElementTree as ET; ET.parse('rules/local_rules.xml'); print('XML Validated Cleanly')"#!/usr/bin/env bash
set -euo pipefail
for file in rules/*.xml; do
echo "Validating $file..."
python3 -c "
import xml.etree.ElementTree as ET
try:
ET.parse('$file')
print('-> $file: Syntax OK')
except Exception as e:
print('-> $file: Syntax ERROR:', e)
exit(1)
"
doneAdd `scripts/validate_rules.sh` to pre-commit hooks to catch malformed tags before agent code is committed.
Ensure any custom `<field>` tags in Wazuh rules use valid regex or sregex syntax; malformed regex will pass basic XML linting but cause runtime compilation failure inside `wazuh-analysisd`.
Real-World Scenario: Configure Custom FIM Rule and Real-Time Alerting for Web App Secret Leakage
“Using wazuh-siem-endpoint-detection, create custom wazuh rule and agent syscheck configuration to monitor /etc/myapp/credentials.json for unauthorized access or modification, and trigger an alert at severity level 12 tagged with MITRE T1552.”
Runtime Troubleshooting & Failure Modes
Root Cause: The agent generated an unescaped special character (such as '&' or unclosed '<match>' tags) inside an alert message or pattern matcher within the XML rule definition.
xmllint --format rules/local_rules.xml -o rules/local_rules.xml && sed -i 's/ & / \& /g' rules/local_rules.xmlRoot Cause: The generated agent configuration specifies an unreachable or unresolvable manager address, or the client protocol was set to UDP instead of TCP on a network blocking port 1514/UDP.
sed -i 's/<protocol>udp<\/protocol>/<protocol>tcp<\/protocol>/g' wazuh_agent.conf && nc -zvw3 ${WAZUH_MANAGER} 1514Frequently Asked Questions (Wazuh SIEM Security Monitoring & XDR SOP)
Q:Can I use Wazuh SIEM Security Monitoring & XDR across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the universal SKILL.md specification supported across all modern agent runtimes. Simply mount the SKILL.md file into the respective configuration folder for each tool (.claude/skills, .cursor/skills, or .codex/skills).
Q:How does Wazuh SIEM Security Monitoring & XDR prevent context window overflow during long agent sessions?
The skill enforces concise XML/template output formats and narrow verification commands instead of streaming massive Wazuh manager logs or multi-megabyte rule lists into the prompt context window.
Q:Does this skill require escalated root or container permissions?
No. The skill is audited with a security score of 98/100 and runs with shell_exec: false and workspace-scoped writes. The agent outputs configurations and scripts safely for admin review before host execution.
Ready to equip your autonomous agent with Wazuh SIEM Security Monitoring & XDR?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.