The Vesper agent

The Agent page is where Vesper stops being a Q&A service and starts being support. You chat with an agent that is connected to your actual Wazuh deployment through the connector: it can look at your agents, your indices and your configuration, reason about what it finds, and, if you allow it, fix what is broken.

Prerequisites

• An environment registered in the console, with a connector installed and showing online.
• Enough service credit: agent runs are metered like questions, on real token cost.

Starting a conversation

1. Open Agent and select an environment from the picker. An environment marked (offline) can be selected, but tool calls against it will fail until its connector reconnects.
2. Ask in plain language. Typical asks:
   • "Which agents are disconnected right now, and since when?"
   • "Why is agent 003 not reporting? Diagnose and fix it."
   • "Check the manager's analysisd queue usage over the last hour."
3. The agent runs a tool-use loop: it plans, calls tools against your environment through the connector, reads the results, and iterates until it can answer or fix.

Follow-ups work: recent turns of the conversation are replayed into the next run, so "now fix it" refers to what you were just looking at. Use New chat to start clean.

Modes

Every environment carries a mode, the ceiling for what the agent may do there. Admins switch it from the Agent page or the environment's card.

Mode	Behavior
Read only	The agent inspects and answers, but never changes anything.
Manual	The agent proposes changes; you approve each one before it is applied.
Auto	The agent applies validated changes on its own.

The mode is enforced server-side, per environment. In Manual mode, a proposed action pauses the run and appears both in the chat (approve/deny inline) and in the Changes ledger. In Auto mode the change is applied without waiting, but is still recorded in the ledger.

:::info Writes are opt-in twice A change needs both the environment mode to allow it and the connector to have the corresponding capability enabled on the host (active_response, or exec for shell-level fixes; see connector configuration). A connector with exec disabled keeps the box read-only no matter the mode. :::

What the agent can reach

Through the connector the agent talks to the environment's own local surfaces:

• the Wazuh indexer query API (alerts, states, statistics),
• the Wazuh manager API (agents, groups, configuration, active response),
• optionally, a gated shell on the node for diagnose-and-fix work, if the connector was installed with --enable-exec.

All of it rides the connector's single outbound mTLS session. Vesper never connects into your network.