# Threat Detection

The Joe Sandbox MCP Server is a Model Context Protocol (MCP) server for interacting with Joe Sandbox cloud services, providing rich malware analysis, IOC extraction, and threat intelligence functions, and can be integrated into MCP - compatible applications.

MCP Fortress is a comprehensive security tool designed for Model Context Protocol (MCP) servers, offering automated vulnerability scanning, runtime protection, risk scoring, and threat detection functions, and supporting integration with AI assistants such as Claude Code through the MCP server mode for security analysis.

WireMCP is an MCP server that provides real-time network traffic analysis capabilities for large language models (LLMs). It realizes data capture, threat detection, and network diagnosis by integrating the Wireshark tool.

This project provides a series of KQL queries to detect abuse behaviors related to the BloodHound BARK toolkit in Azure AD tenants. These queries aim to identify behaviors simulated by BARK rather than the use of the tool itself. The content includes detection queries for different BARK functions, control suggestions, and relevant resource links.

This is an MCP server project for interacting with the Google Chronicle Security Operations Suite, providing functions such as security event search and alert retrieval.

The Threat.Zone MCP server is a malware analysis service interface built on FastMCP, providing LLMs with a standardized threat analysis toolset that supports file/URL detection, sandbox analysis, network behavior monitoring, and other functions.