Wazuh Python Packages

wazuhcoverage

A small batch CLI for measuring coverage in Wazuh JSON archives.

wazuhtester

wazuhtester is a Python library and command-line tool for interacting with the Wazuh wazuh-logtest daemon.

rule-doctor-lite

Free read-only check: which custom Wazuh rules never fire, and why (including rules Wazuh drops at load). Python 3, one file.

wazuhevtx

A Python tool that parses EVTX files and converts them into JSON formatted logs mimicking Wazuh agent behavior in version 4.x. wazuhevtx is designed as a helper for wazuh-logtest tool.

rulevis

RuleVis is a powerful analysis tool that transforms your Wazuh ruleset into a dynamic, interactive force-directed graph. It helps you visualize the complex relationships between rules, identify critical dependencies, discover structural issues, and analyze the distribution of your rule IDs.

wazuhscatune

A helper for Wazuh Security Configuration Assessment (SCA) to create a custom SCA based on loosening.

wresult

wresult provides the running configuration of a Wazuh agent by reconstructing how it applies ossec.conf and agent.conf.

wazuhtestgen

A tool to help detection engineers generate Wazuh rule tests either derived from INI test files from Wazuh repository, Windows Event Log (EVTX) files, or Wazuh rule files. The test format uses Python's unittest. It is designed to accompany wazuh-devenv project.

klaxon-mcp

MCP server for Wazuh 5.x. Query any events or findings datastream, discover which schema fields are actually populated, run logtest. Generic tools instead of fifty narrow ones. 5.x only — no 4.x compatibility layer.

wazuhregex

wazuhregex is a Python package and command-line tool that implements Wazuh regex behavior for local testing and development. It lets you validate one pattern against all three Wazuh regex engines in one run.

pyjq-ng

A simple Python package to Query over Json Data

django-audit-wazuh

Django middleware and signals for handling security events

security-shallots

Small-footprint AI security scout for homelabs & small networks (1-10 machines). SIEM/NSM value without the 200GB data lake, runs on a Raspberry Pi.