Post-quantum TLS + cert checks; Wazuh rules tested on a real manager: does your rule fire?
Score is being calculated.
Finds Wazuh custom rules that pass wazuh-analysisd -t but are dropped at load (load order across ruleset/rules and etc/rules, missing parents, duplicate or colliding ids). Input: list of {filename, xml}. Supported versions: 4.14.7, 4.14.9. Free: counts + 2 findings. Full report: pass api_key.
| Name | Required | Description | Default |
|---|---|---|---|
| files | Yes | Custom rule files, each {"filename": "0094-local.xml", "xml": "<group>...</group>"}; filename exactly as in /var/ossec/etc/rules/, up to 20 files. | |
| api_key | No | Optional key for the full report. Without it you get counts and 2 findings; the full report is also sold per call by x402 at POST https://atkvn.com/agent/v1/wazuh-audit. | |
| wazuh_version | No | Wazuh manager version: 4.14.7 or 4.14.9. | 4.14.9 |
Does this public hostname negotiate hybrid post-quantum key exchange (X25519MLKEM768)? Returns TLS version, hybrid yes/no and a one-line verdict. Free. One TLS handshake per probe, no scanning.
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes | Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused. |
Certificate issuer, expiry date, days left, and whether the chain verifies for the hostname from a strict client (catches missing intermediate certificates and name mismatches). Free.
| Name | Required | Description | Default |
|---|---|---|---|
| hostname | Yes | Public DNS hostname, e.g. www.example.com. IP addresses and internal names are refused. |
Runs log lines through a real wazuh-manager 4.14.9 (fresh logtest session) with your custom rules and decoders: which decoder and rule matched, whether YOUR rule fired, and load warnings such as 7617/7619. Logtest engine: frequency/timeframe rules and some live-only behaviour are out of scope. Free: 1 log line with your files (3 with the stock ruleset only), summary. 10 lines with decoded fields and full alerts: POST https://atkvn.com/agent/v1/wazuh-testfire (x402, USD 0.10).
| Name | Required | Description | Default |
|---|---|---|---|
| logs | Yes | Raw log lines exactly as the agent would forward them, one event per item. | |
| rules | No | Optional custom rule files: [{"filename": "0096-local.xml", "xml": "<group>...</group>"}]. Filename order matters: files load by name together with the stock ruleset. | |
| decoders | No | Optional custom decoder files, same shape as rules. | |
| log_format | No | Wazuh log_format, e.g. syslog or json. | syslog |
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
audit_wazuh_rulescheck_post_quantum_tlscheck_tls_certificatetest_wazuh_rulePassive domain-perimeter checks — cert expiry, subdomain takeover, lookalikes — as agent tools
Vendor status pages, TLS cert inspection, DNS propagation checks, and incident-response playbooks.
Passive OSINT and security recon: DNS, TLS, email posture, IP reputation, CVE/KEV, CT logs.
55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
Add one secure layer between your agents and this server.
