Wazuh-Autopilot

Grade A: derived only from the two verdicts below. How grades work

Agentic SOC for Wazuh built on Strands Agents: a 13-agent swarm with 37 Wazuh-verified skills triages, investigates and plans response through the Wazuh MCP Server. Policy-gated autonomy, approvals, RBAC, audit, tracing and evals in one Docker stack. Bedrock, Anthropic, NVIDIA NIM, vLLM, LiteLLM or air-gapped Ollama.

ActiveCurrent depsChecked Oct 19, 2026Free

Visit Wazuh-Autopilot ↗Source on GitHub ↗

Why this verdict

How we check →

22 commits by 1 contributor in the last 90 days (4 in the last 30). receipt ↗
Latest release v3.0.0, 25 days ago. receipt ↗
On current major: Pydantic, SQLAlchemy. receipt ↗
Not counted in verdict: FastAPI 0 → 0. receipt ↗

Snapshot: commit 07da85f on main, checked 2026-10-19 07:42 UTC. Receipts link to files at this exact commit.

Dependency freshness

Package	Declared	Latest	Status
FastAPI fastapi	0.115.0	0.146.0	Behind, not counted
Pydantic pydantic	2.7.0	2.14.1	Current
SQLAlchemy sqlalchemy	2.0.0	2.1.5	Current

Declared = lowest version the kit's dependency file (package.json, pyproject.toml or requirements.txt) allows. Latest = the npm "latest" tag or the newest PyPI release. TypeScript, the Stripe SDK, FastAPI and other 0.x packages are shown but not counted in the verdict.

What's in the stack

Framework: FastAPI
Database / ORM: SQLAlchemy, PostgreSQL (psycopg)
AI: MCP SDK
API layer: Pydantic, Uvicorn

Detected from declared dependencies. A listed package means it's installed, not necessarily fully wired up.

What the README says you get

Admin
Autonomy policy levelsFour levels: observe, recommend, supervised, autonomous
Admin
Per-action rulesper-action rules (confidence floor, hourly budget), per-agent caps
Admin
Two-person rulea two-person rule and a business-hours limit
Admin
RBAC and audit logRBAC (5 roles), audit log, Postgres
AI
13-agent SOC swarm13 agents / 37 skills
AI
Agent Skills library37 Agent Skills (`SKILL.md`)
AI
Incident-response playbooks7 incident-response playbooks
Analytics
Metrics and tracingOpenTelemetry export, Prometheus `/metrics`
Other
Tool filter safetythe MCP tool filter and a pre-tool hook both block them
Testing
Evals suites`strands-agents-evals` suites, restart recovery, trace retention

Extracted from the kit's README by a local AI model (deepseek-flash) on Sep 29, 2026. Every item is checked against an exact README quote; 4 unverifiable items were discarded. A README claim is the maker's description, not something we tested.

Watch Wazuh-Autopilot

Get told if it goes dormant, gets archived, falls further behind on a core dependency, or changes its license or price.

RSS feed for Wazuh-Autopilot · all changes

History

Sep 29, 2026 → Oct 19, 2026. One square per check, colored by maintenance status. Hover for details.

Show as a table

Date	Maintenance	Dependencies	Commits (90d)
Oct 19, 2026	Active	Current deps	22
Oct 12, 2026	Active	Current deps	22
Sep 29, 2026	Active	Current deps	22

Sources

Every claim on this page comes from these public records, checked Oct 19, 2026. Open them to verify.

Commit history ↗ default branch (main) at the checked commit: pulse, contributors, last commit
Releases ↗ latest release
backend/requirements.txt ↗ declared dependency versions and stack (at commit 07da85f)
README ↗ quoted features at the checked commit
PyPI ↗ latest versions of Python packages (each linked in the table above)

Maintainer? Add the badge

It updates automatically every time we refresh the evidence. Clicking it opens this page.

[![kitproof](https://kitproof.dev/badge/wazuh-autopilot.svg)](https://kitproof.dev/kits/wazuh-autopilot/)