Give your AI agents structured access to your SIEM.
Vigil Connect sits on top of Wazuh, Elastic, or Splunk. Your AI agents get clean JSON alerts and a structured API. No new agents on endpoints.
vigil connector add wazuh --name prod --indexer-url https://wazuh:9200 --indexer-user admin --indexer-pass <pass>How it works
Three steps to AI-powered investigation.
Connect
Point Vigil at your existing Wazuh or Elastic deployment.
vigil connector add wazuh
Investigate
AI agents read structured JSON alerts directly.
vigil feed alerts --severity high --output json
Act
Acknowledge false positives, escalate real threats, get full log context.
vigil feed context <alert-id> --window 10m --output json
Supported SIEMs
Works with your existing stack.
Wazuh
Available nowFull support. Alerts via OpenSearch, context via archives.
Elastic
Available nowFull support. Security alerts via .alerts-security index, ancestor-based context.
Splunk
Coming soonIntegration in progress.
Microsoft Sentinel
Coming soonIntegration in progress.
Design decision
AI reads raw JSON better than normalized schemas.
Every SIEM uses different field names. Building a normalization layer takes months and breaks with every SIEM version upgrade. A normalized schema is a bet that you can predict every field an AI agent will ever need — and that bet always loses.
Instead, Vigil passes raw alert JSON to the AI. Claude reads Wazuh's rule.description and Elastic's kibana.alert.rule.name equally well. The model understands structure without being told what the structure means.
The only fields Vigil extracts: id, severity, source_siem, and raw — the entire original alert, untouched.
Investigation flow
The full workflow in three commands.
# Step 1: Get recent high-severity alerts vigil feed alerts --severity high --since 1h --output json # Step 2: Investigate a specific alert (get surrounding raw logs) vigil feed context <alert-id> --window 10m --output json # Step 3: Acknowledge or escalate vigil alerts acknowledge <id> --note "False positive — dev build server"
Claude Code integration
Deploy with Claude Code in one command.
After running, Claude Code knows how to deploy agents, add connectors, and investigate alerts. No MCP server. No running process. Just instructions.
npx @vigil/skill