MCP Server: Support Multiple SIEM Platforms, Integrate 71+ Tools, Auto-generate Security Detection Rules

Security Detections MCP

Security Detections MCP is a server based on the Model Context Protocol that allows LLMs to query a unified security detection rule database covering Sigma, Splunk ESCU, Elastic, and KQL formats. The latest version 3.0 is upgraded to an autonomous detection engineering platform that can automatically extract TTPs from threat intelligence, analyze coverage gaps, generate SIEM-native format detection rules, run tests, and verify. The project includes over 71 tools, 11 pre-built workflow prompts, and a knowledge graph system, supporting multiple SIEM platforms.

Security Developer tools #Security Detection #Threat Analysis #Autonomous Engineering #Multi-Platform Support .TypeScript

rating : 4 points

downloads : 6.7K

update time : 2026-03-13

Open Site

What is Security Detections MCP?

Security Detections MCP is an intelligent security detection platform that unifies detection rules from different security tools (Sigma, Splunk, Elastic, KQL) into a single database, allowing AI assistants to intelligently query, analyze, and generate security detection rules. The latest version 3.0 is an autonomous detection engineering platform that can automatically analyze threat intelligence, identify coverage gaps, generate detection rules, and verify their effectiveness.

How to use Security Detections MCP?

You can connect to the server by configuring an MCP client (such as Cursor, Claude Desktop, VS Code), and then use natural language to query detection rules, analyze security coverage, generate new detection rules, or run expert-level security assessment workflows.

Applicable Scenarios

Suitable for security analysts, detection engineers, SOC teams, threat hunters, and red/blue team members for security tasks such as quickly querying existing detection rules, identifying security coverage gaps, generating new detection rules, assessing ransomware readiness, and simulating APT attack coverage.

Main Features

Unified Detection Rule Query

Query over 7,200 detection rules from Sigma, Splunk ESCU, Elastic, and KQL from a single interface, supporting full-text search, MITRE ATT&CK technique filtering, CVE filtering, etc.

Autonomous Detection Engineering Platform (New in 3.0)

Automatically analyze threat intelligence, extract TTPs, identify coverage gaps, generate SIEM-native detection rules, run Atomic Red Team tests, and verify detection effectiveness.

11 Expert-Level Workflow Prompts

Pre-built expert workflows, including ransomware readiness assessment, APT threat simulation, purple team exercises, SOC investigation assistance, and executive security briefings.

Detection Engineering Intelligence

Learn patterns from existing detection rules, automatically generate detection templates, track commonly used fields and macro references, and suggest improvements based on patterns.

Knowledge Graph/Tribal Knowledge

Persist a knowledge graph to record the reasons and context of analysis decisions, helping future AI assistants understand the logic of historical decisions.

Multi-SIEM Platform Support

Supports Splunk, Microsoft Sentinel, Elastic, and Sigma formats, and can generate detection rules for the corresponding platforms according to the configuration.

Over 71 Tools

Provides over 71 tools covering multiple categories such as core detection queries, engineering intelligence, knowledge management, dynamic analysis, and autonomous analysis.

MCP Resource and Parameter Completion

Provides readable MCP resource context and automatic parameter completion to help AI assistants better understand available data and use tools correctly.

Advantages

Unified query of detection rules from multiple security platforms, saving time on switching tools

Automated threat analysis and detection generation, significantly improving detection engineering efficiency

Pre-built expert workflows ensure consistency and professionalism in analysis

Knowledge graph records decision-making logic, forming inheritable tribal knowledge

Supports human-in-the-loop review, with all PRs created as drafts to ensure security and controllability

Cross-platform support, can run on macOS, Windows (WSL and native), and Linux

Limitations

Requires configuration of detection rule source paths, with a certain complexity in initial setup

Pattern extraction may not be accurate enough for complex expressions in KQL and Elastic formats

Some advanced features (such as interactive confirmation, sampling) require client support

Coverage analysis depends on the accuracy of MITRE tags in the source data

Requires Anthropic API key and Node.js environment

How to Use

Installation and Configuration

Run directly via npx or clone the repository and build locally. Configure environment variables to point to your detection rule source paths.

Configure MCP Client

Configure the MCP server connection in Cursor, Claude Desktop, or VS Code, and set environment variables.

Download Detection Rule Content

Use the provided script to quickly download all detection rule sources, or manually clone the relevant repositories.

Start Querying and Analyzing

Use an AI assistant to query detection rules, run expert workflows, or start autonomous detection engineering using natural language.

Usage Examples

Ransomware Readiness Assessment

Comprehensively assess the organization's detection and response capabilities against the ransomware attack chain, identify key vulnerabilities, and provide a remediation roadmap.

APT Threat Simulation Analysis

Assess the detection coverage of specific advanced persistent threat (APT) groups, such as APT29, Lazarus, Volt Typhoon, etc.

Detection Engineering Sprint Planning

Generate a prioritized detection development backlog based on threat intelligence, including user stories and acceptance criteria.

CVE Response Assessment

Quickly assess the existing detection coverage of newly disclosed CVE vulnerabilities and generate immediate action suggestions.

Executive Security Briefing

Generate a professional security briefing for the board or CISO, using business risk language and investment suggestions.

Frequently Asked Questions

What prerequisites are required for this MCP server?

How to obtain the detection rule content?

Will the autonomous detection engineering platform automatically submit code?

Which SIEM platforms are supported?

How to test the coverage of a specific MITRE technique?

What should Windows users do if they encounter an EBUSY error?

How to use it in conjunction with the MITRE ATT&CK MCP?

What is Tribal Knowledge?

Related Resources

GitHub Repository

Project source code, issue tracking, and latest updates

Setup Guide

Detailed installation and configuration guide covering macOS, Windows, and Linux systems

Autonomous Platform Documentation

Detailed documentation for the v3.0 autonomous detection engineering platform

End-to-End Testing Guide

Complete testing guide by SIEM platform (Splunk, Sentinel, Elastic, Sigma)

MITRE ATT&CK MCP

Supporting MITRE ATT&CK MCP server, providing threat framework data

Sigma Rule Repository

Official repository for Sigma detection rules

Splunk Security Content

Splunk ESCU detection rules and stories

Elastic Detection Rules

Elastic detection rule repository

🚀 Claude Skills for Detection Engineering

This directory offers Claude Skills that deliver specialized knowledge for detection engineering, threat intelligence analysis, and security content development.

🚀 Quick Start

This directory contains Claude Skills that provide specialized expertise for detection engineering, threat intelligence analysis, and security content development.

✨ Features

What are Skills?

Skills are packages of expertise that teach Claude how to excel at specific tasks. Unlike MCPs (Model Context Protocol) which provide data access, Skills provide methodology and best practices.

MCPs = Access to your data (Splunk, detection database, MITRE ATT&CK)
Skills = Expert knowledge (CTI analysis, detection engineering, query optimization)

Claude automatically loads relevant skills based on your task.

Available Skills

Skill	Priority	When to Use
cti-detection-engineer	Core	Threat analysis, MITRE mapping, detection design
detection-yaml-engineer	Core	Creating/validating detection rule files
threat-report-parser	Core	Analyzing threat reports and extracting TTPs
detection-reviewer	Core	QA review before deployment
detection-test-engineer	Core	Creating test scenarios for detections
atomic-red-team-testing	Testing	Running atomic tests for validation
attack-range-builder	Testing	Building test environments
custom-atomics-deployment	Testing	Creating custom attack simulations
attack-navigator-generator	Visualization	ATT&CK Navigator layers and coverage maps
analytic-story-builder	Organization	Grouping detections into stories/use cases
supply-chain-analyst	Specialty	Supply chain attack analysis
spl-optimizer	Specialty	Splunk SPL query optimization
data-source-mapper	Reference	Mapping detections to data sources
pr-extension-workflow	Workflow	Extending PR coverage

SIEM Platform Support

These skills are designed to be SIEM-agnostic. Set $SIEM_PLATFORM in your agents/.env to customize output:

Value	Output Format	Validation	Best For
`splunk`	SPL with CIM data models	`contentctl validate`	Splunk shops, security_content contributors
`sentinel`	Microsoft Sentinel KQL	Azure CLI	Microsoft / Azure shops
`elastic`	Elastic Security EQL/ES\|QL	detection-rules CLI	Elastic shops
`sigma`	Platform-agnostic Sigma YAML	pySigma conversion	Multi-SIEM, maximum portability

⚠️ Important Note

Attack Range is only required for the splunk platform with automated atomic testing. For other SIEMs:

Sentinel: Use Azure VMs with Defender for Endpoint

Elastic: Use Docker-based Elastic Stack with Elastic Agent

Manual testing: Any VM with Sysmon + Invoke-AtomicRedTeam installed

No lab needed: Set DRY_RUN=true for rule authoring without live validation

See docs/E2E-TESTING-GUIDE.md for complete lab setup per SIEM.

Environment Variables

Skills reference these environment variables for portability:

Variable	Description	Example	Required
`SIEM_PLATFORM`	Target SIEM platform	`splunk`	Yes
`SECURITY_CONTENT_PATH`	Detection content repository	`./security_content`	Yes
`VALIDATION_TOOL`	Validation command override	`contentctl validate`	No (has defaults)
`ATTACK_RANGE_PATH`	Attack Range installation	`./attack_range`	Splunk only
`ATTACK_DATA_PATH`	Attack data repository	`./attack_data`	Splunk only

Integration with MCPs

Skills work best when combined with MCP servers:

MCP Server	What It Provides	Required For
`security-detections`	Detection database, coverage analysis, gap identification	All SIEMs
`splunk-mcp`	Live Splunk queries, detection validation	Splunk only
`mitre-attack`	Technique lookup, group TTPs, Navigator layers	All SIEMs

💡 Usage Tip

Non-Splunk users: You don't need splunk-mcp. The security-detections MCP indexes rules from all formats (Sigma, Splunk, Elastic, KQL) regardless of which SIEM you use for live validation.