What is Vesper?
Vesper is the Wazuh Labs support service, live at vesper.wazuh.com. It does two related things:
- Answers Wazuh questions. Ask anything about installing, configuring, tuning or troubleshooting Wazuh. Vesper retrieves the most relevant resolved threads from the community support corpus and generates a structured answer grounded in them, citing its sources.
- Supports your actual environment. The Vesper agent connects to your own Wazuh deployment through the connector and works on it like a support engineer: it inspects agents and indices, diagnoses misconfigurations, and, when you allow it, applies fixes.
How answering works
Vesper is a retrieval-augmented generation (RAG) service. Years of community support conversations, from the Wazuh Slack, Discord, Google Groups and GitHub, are continuously ingested, stripped of personal identities, and embedded into a vector index. When you ask a question:
- Your question is embedded with the same model used for the corpus.
- The most similar support threads are retrieved from the index.
- A generation model writes the answer using only those threads as context, in a consistent Summary / Diagnosis / Steps / Verification format.
- The answer is returned together with the source threads and their similarity scores, so you can judge how well grounded it is.
See Reading answers and The knowledge corpus for details.
How agentic support works
The agent runs a tool-use loop against your registered environments. Each environment is a Wazuh deployment with a connector installed on it. The connector dials out to Vesper over mTLS, so nothing in your network needs to be exposed, and relays read queries (and only the writes you explicitly allow) to the local Wazuh indexer and API.
Every environment has a mode ceiling you control:
| Mode | What the agent may do |
|---|---|
| Read only | Inspect and answer. Never changes anything. |
| Manual | Propose changes. Each one waits for your approval in Changes. |
| Auto | Apply validated changes on its own, still recorded in the ledger. |
Part of the Wazuh Labs ecosystem
Vesper shares its identity and billing rails with the other Wazuh Labs services (Mobius, Umbra, Argus, Lumen), all reachable from the Wazuh Hub:
- One account. You sign in with Wazuh ID, the shared ecosystem login. Your organization is your tenant across every service.
- One card. Paid usage across services is billed to the organization card managed in the Hub. See Billing.