MCP serverCommunity

Security Detections

Search security detections across Sigma, Splunk, Elastic, KQL, Sublime, CQL and Jamf with ATT&CK.

MHaggis · ↓ 0 installs

Install

Add the config to your client settings. Replace values in <angle brackets> with your own.

claude_desktop_config.json

{
  "mcpServers": {
    "security-detections-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "security-detections-mcp@3.3.4"
      ],
      "env": {
        "SIGMA_PATHS": "<SIGMA_PATHS>",
        "SPLUNK_PATHS": "<SPLUNK_PATHS>",
        "ELASTIC_PATHS": "<ELASTIC_PATHS>",
        "KQL_PATHS": "<KQL_PATHS>",
        "SUBLIME_PATHS": "<SUBLIME_PATHS>",
        "CQL_HUB_PATHS": "<CQL_HUB_PATHS>",
        "JAMF_PROTECT_PATHS": "<JAMF_PROTECT_PATHS>",
        "STORY_PATHS": "<STORY_PATHS>"
      }
    }
  }
}

Or in one command — the CLI adds the server to your client config:

CLI

npx ai-point add io.github.MHaggis/security-detections-mcp

Tools

The tool list will appear once the server has a sandbox or the editors fill it in.

Report a problem ↗ (Opens GitHub in a new tab)