菜单
Real-time Wazuh SIEM security dashboard with PAI chat integration. USE WHEN user mentions wazuh dashboard, security alerts, SIEM monitoring, alert analysis, OR wants to view security events with AI assistance.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
AI image generation for blog posts, presentations, and content creation. USE WHEN user mentions generate image, create artwork, blog image, header image, presentation visual, AI art, Replicate, DALL-E, Midjourney, OR wants visual content for publications and marketing materials.
Security-first multi-agent development team with PM, developers, QA, security audit, and code review. USE WHEN user mentions dev team, development team, multi-agent development, orchestrate coding agents, parallel development, coordinate developers, build feature, implement code, carbeneai, cyberdefensetactics, purpleteamops, OR wants autonomous software development with security gates.
Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks about CMMC 2.0, CMMC Level 1, Level 2, or Level 3, DoD cybersecurity compliance, NIST SP 800-171, CUI (Controlled Unclassified Information) protection, System Security Plan (SSP), Plan of Action & Milestones (POA&M), C3PAO assessments, DIBCAC audits, self-assessment, SPRS score, or any requirement under DFARS 252.204-7012 or 7021. Also trigger for: "CMMC gap analysis", "CMMC readiness", "FCI protection", "CUI scoping", "CMMC practices", "DoD contract cybersecurity", "defense supply chain security", or "prime contractor flow-down requirements".
Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT incident classification or reporting, threat-led penetration testing (TLPT), ICT third-party risk management, Register of Information, contractual provisions with ICT providers, ICT concentration risk, oversight of critical ICT third-party service providers (CTPPs), or any DORA RTS/ITS obligation. Also trigger for: "DORA gap analysis", "DORA readiness", "Art. 6 ICT risk framework", "Art. 17 incident reporting", "Art. 26 TLPT", "Art. 28 third-party policy", "Art. 30 contractual provisions", "Register of Information CIR 2024/2956", "critical TPSP designation", "DORA vs NIS2", "DORA simplified framework", or EBA/ESMA/EIOPA digital resilience guidance.
Expert India Digital Personal Data Protection Act, 2023 (DPDPA) compliance advisor. Use this skill whenever a user asks about the DPDPA, DPDP Act, DPDP Rules 2025, India data privacy law, Data Fiduciary obligations, Data Principal rights, Significant Data Fiduciary, Data Protection Board of India, consent under DPDPA, notice requirements, breach notification India, children's data India, cross-border data transfer India, India privacy compliance, DPDPA gap analysis, DPDPA vs GDPR, or any obligation under India's personal data protection framework. Also trigger for: "Section 6 consent", "Section 7 legitimate uses", "Section 9 children's data", "Section 10 SDF", "Section 16 cross-border", "Rule 6 breach notification", "Rule 13 SDF obligations", "Data Protection Board complaint", "verifiable parental consent India", "DPDPA compliance roadmap", or "India privacy law global company".
Expert guidance for FedRAMP certification and compliance. Use this skill whenever a user asks about FedRAMP authorization, ATO (Authority to Operate), cloud security for federal government, NIST SP 800-53 controls, CSP compliance, or any of the core FedRAMP document types: SSP, SAP, SAR, POA&M, CIS/CRM workbooks. Also trigger for questions about FedRAMP impact levels (Low, Moderate, High, LI-SaaS), FedRAMP 20x, OSCAL, 3PAO assessments, continuous monitoring (ConMon), gap assessments, system boundary definition, FedRAMP readiness, or architecture reviews for federal cloud. When in doubt, use this skill — it covers the full FedRAMP lifecycle from readiness through continuous monitoring.
| name | WazuhDashboard |
| description | Real-time Wazuh SIEM security dashboard with PAI chat integration. USE WHEN user mentions wazuh dashboard, security alerts, SIEM monitoring, alert analysis, OR wants to view security events with AI assistance. |
Real-time security monitoring dashboard for Wazuh SIEM alerts with integrated PAI chat for contextual analysis.
Wazuh (10.0.0.60) → n8n webhook → JSONL file → Dashboard Server (WebSocket) → Vue Client
↓
PAI API (localhost:3001)
| Component | Port | URL |
|---|---|---|
| Server (API/WebSocket) | 4001 | http://localhost:4001 |
| Client (Vue/Vite) | 5173 | http://localhost:5173 |
| Production | 443 | https://wazuh-dashboard.home.yourdomain.com |
| Level | Range | Color | Hex |
|---|---|---|---|
| Critical | 12+ | Red | #f7768e |
| High | 7-11 | Amber | #e0af68 |
| Medium | 3-6 | Purple | #bb9af7 |
| Low | 0-2 | Green | #9ece6a |
# Start dashboard
~/.claude/skills/WazuhDashboard/manage.sh start
# Stop dashboard
~/.claude/skills/WazuhDashboard/manage.sh stop
# Restart
~/.claude/skills/WazuhDashboard/manage.sh restart
# Check status
~/.claude/skills/WazuhDashboard/manage.sh status
Add to ~/.claude/.env:
WAZUH_PAI_API_KEY=<your-claude-api-key>
WAZUH_ALERTS_PATH=/path/to/your/wazuh-alerts/alerts.jsonl
Configure n8n workflow to receive Wazuh alerts and append to JSONL file:
https://n8n.home.yourdomain.com/webhook/wazuh-alerts$WAZUH_ALERTS_PATHAdd to /var/ossec/etc/ossec.conf on Wazuh manager (configure your Wazuh IP):
<integration>
<name>custom-webhook</name>
<hook_url>https://n8n.home.yourdomain.com/webhook/wazuh-alerts</hook_url>
<level>5</level>
<alert_format>json</alert_format>
</integration>
WazuhDashboard/
├── SKILL.md
├── manage.sh
├── apps/
│ ├── server/
│ │ ├── package.json
│ │ ├── tsconfig.json
│ │ └── src/
│ │ ├── index.ts
│ │ ├── alert-ingest.ts
│ │ ├── pai-client.ts
│ │ └── types.ts
│ └── client/
│ ├── package.json
│ ├── vite.config.ts
│ ├── tailwind.config.js
│ ├── postcss.config.js
│ ├── index.html
│ └── src/
│ ├── main.ts
│ ├── App.vue
│ ├── types.ts
│ ├── styles/
│ │ └── main.css
│ ├── composables/
│ │ ├── useWebSocket.ts
│ │ └── usePAIChat.ts
│ └── components/
│ ├── AlertFeed.vue
│ ├── AlertRow.vue
│ ├── AlertStats.vue
│ ├── ChatPanel.vue
│ └── FilterPanel.vue
└── workflows/
└── Deploy.md
Example 1: View live security alerts
User: "Start wazuh dashboard"
→ Runs manage.sh start
→ Opens dashboard at http://localhost:5173
→ Live alerts stream in real-time
Example 2: Analyze specific alert
User: "What does this brute force alert mean?"
→ PAI analyzes selected alert context
→ Provides explanation and remediation steps
Example 3: Filter high-severity alerts
User: "Show only critical and high alerts"
→ Applies severity filter
→ Displays filtered alert stream