Security Detections MCP

Tools 60 of 80

41 only read, 14 change things, 5 can delete or overwrite. A ? marks an optional parameter.

search

Full-text search over every indexed detection field, 50 results unless limit is set (up to 500)query: stringlimit?: numbersource_type?: enum

get_by_id

Fetch one detection by its IDid: string

get_raw_yaml

Return the original rule file text for a detectionid: string

list_all

Page through all indexed detections, 100 at a time by defaultlimit?: numberoffset?: number

list_by_source

Filter detections by format, such as sigma, splunk_escu or elasticsource_type: enumlimit?: numberoffset?: number

list_by_mitre

Detections mapped to an ATT&CK technique IDtechnique_id: stringlimit?: numberoffset?: number

list_by_mitre_tactic

Detections for an ATT&CK tactic such as persistencetactic: enumlimit?: numberoffset?: number

list_by_cve

Detections that reference a given CVEcve_id: stringlimit?: numberoffset?: number

list_by_severity

Filter detections by severity levellevel: enumlimit?: numberoffset?: number

list_by_logsource

Filter Sigma rules by log source category, product or servicecategory?: stringproduct?: stringservice?: stringlimit?: numberoffset?: number

list_by_analytic_story

Splunk detections that belong to an analytic storystory: stringlimit?: numberoffset?: number

get_stats

Counts of indexed detections by source and other facets

rebuild_index deletes

Delete the database file and index the configured folders again, after a confirmationconfirm?: booleanskip_elicitation?: boolean

analyze_coverage

Summarise coverage by tactic, top techniques and weak areassource_type?: enum

identify_gaps

List uncovered techniques for a threat profile such as ransomwarethreat_profile: enumsource_type?: enum

suggest_detections

Ideas for new detections for one techniquetechnique_id: stringsource_type?: enum

get_coverage_summary

Short per-tactic coverage percentagessource_type?: enum

get_top_gaps

The most significant uncovered techniques for a threat profilethreat_profile: enum

compare_sources

Compare how each detection format covers a topictopic: stringlimit_per_source?: number

smart_compare

Compare sources on a topic or technique in one calltopic: string

generate_navigator_layer

Produce an ATT&CK Navigator layer JSON for coveragename: stringdescription?: stringsource_type?: enumtactic?: enumseverity?: enum

analyze_procedure_coverage

Break one technique's coverage down by behaviourtechnique_id: stringsource_type?: enuminclude_query_snippets?: boolean

compare_procedure_coverage

Compare behaviour-level coverage across sourcestechnique_id: stringsources?: array

list_actors

List threat actors loaded from ATT&CK STIX datasearch?: stringlimit?: number

get_actor_profile

Show one threat actor's techniques and softwareactor_name: string

analyze_actor_coverage

Measure detection coverage against one threat actoractor_name: stringsource_type?: enuminclude_navigator_layer?: boolean

compare_actor_coverage

Compare coverage across several threat actorsactor_names: arraysource_type?: enum

search_stories

Search Splunk analytic storiesquery: stringlimit?: number

get_story

Fetch one analytic storyname: string

get_query_patterns

Common query patterns learned from indexed rules for a techniquetechnique_id: stringsource_type?: enum

get_field_reference

Fields seen in rules for a data model or sourcedata_model: string

get_macro_reference

Splunk macros used across the indexed rulesfilter?: string

find_similar_detections

Find rules that resemble a given descriptiondescription: stringtechnique_id?: stringsource_type?: enumlimit?: number

suggest_detection_template

Draft a detection skeleton from learned patternstechnique_id: stringdescription: stringdata_model?: stringdetection_type?: enumplatform?: enum

generate_rba_structure

Draft a Splunk risk-based alerting block for a detectiondetection_type: enumseverity: enumdescription: stringfields_available?: array

extract_patterns changes

Mine the index for query patterns and store themforce?: boolean

learn_from_feedback changes

Record corrections so later suggestions use themfeedback_type: enumoriginal: stringcorrected: stringcontext?: string

save_query changes

Store a query result under a name, with an optional expiryname: stringquery_type: stringdata: objectttl_minutes?: number

save_template changes

Save a reusable query templatename: stringtemplate: stringdescription?: string

run_template

Run a saved template with parametersname: stringparams?: object

delete_template deletes

Remove a saved templatename: string

create_entity changes

Add a node to the local knowledge graphname: stringentity_type: string

create_relation changes

Link two knowledge graph nodes with a reasonfrom_entity: stringto_entity: stringrelation_type: stringreasoning: stringconfidence?: number

add_observation changes

Attach a note to a knowledge graph nodeentity_name: stringobservation: stringsource?: stringconfidence?: number

delete_entity deletes

Remove a knowledge graph nodename: string

delete_observation deletes

Remove one note from a nodeobservation_id: string

search_knowledge

Search the stored knowledge graphquery: stringlimit?: number

log_decision changes

Store an analysis decision with its reasoningdecision_type: stringcontext: stringdecision: stringreasoning: stringentities_involved?: arrayoutcome?: stringsession_id?: string

add_learning changes

Store a lesson for later sessionslearning_type: stringtitle: stringinsight: stringevidence?: stringapplications?: string

get_relevant_decisions

Recall past decisions that match a contextcontext_query: stringdecision_type?: stringsession_id?: stringlimit?: number

get_learnings

Recall stored lessons for a tasktask_query: stringlearning_type?: stringlimit?: numbermark_applied?: boolean

create_table changes

Create a custom table in the local databasename: stringdescription: stringcolumns: array

insert_row changes

Add a row to a custom tabletable_name: stringdata: objectrow_id?: string

query_table

Read rows from a custom table with filterstable_name: stringwhere?: objectselect?: arrayorder_by?: arraylimit?: number

list_tables

List custom and built-in tablesinclude_prebuilt?: boolean

drop_table deletes

Delete a custom table, with confirm settable_name: stringconfirm: boolean

auto_analyze_coverage changes

Run coverage analysis for several threat profiles and store the resultsthreat_profiles?: arraystore_results?: booleananalysis_name?: stringsession_id?: string

auto_gap_report changes

Build a gap report with recommendations and store itreport_name?: stringcompare_sources?: booleaninclude_recommendations?: booleanpriority_tactics?: arraysession_id?: string

auto_compare_sources changes

Compare sources across key techniques and store the findingstechniques_to_compare?: arrayfocus_tactic?: stringinclude_quality_analysis?: booleansession_id?: string

llm_enhanced_analysis

Ask the client's model, through MCP sampling, to interpret detection dataanalysis_type: stringthreat_profile?: stringtechniques?: arraycustom_context?: string

Resources 12

detection://stats

Index statistics

detection://coverage

Coverage summary

detection://gaps/ransomware

Ransomware coverage gaps

detection://gaps/apt

APT coverage gaps

detection://top-covered

Best covered techniques

detection://sources/comparison

Coverage compared by source

knowledge://graph/summary

Knowledge graph summary

knowledge://decisions/recent

Recently logged decisions

knowledge://learnings/all

All stored lessons

detection://technique/{techniqueId}

Detections for one technique

detection://actor/{actorName}

One threat actor's profile

knowledge://entity/{entityName}

One knowledge graph node

Prompts 11

ransomware-readiness-assessment

Walk through detection coverage against ransomware behaviour

apt-threat-emulation

Plan an emulation of an APT group mapped to your detections

purple-team-exercise

Design a purple-team exercise for a tactic or technique

soc-investigation-assist

Gather detections and context for an alert or indicator

detection-engineering-sprint

Plan a sprint of prioritised detection work

executive-security-briefing

Summarise detection posture for a board, CISO or CTO

cve-response-assessment

Check coverage for a CVE or named vulnerability

data-source-gap-analysis

Compare needed data sources with what the detections use

detection-quality-review

Review the quality of detections for one technique

threat-landscape-sync

Line detection priorities up with current threats for an industry

detection-coverage-diff

Compare your coverage against a set of threats