security-detections-mcp
MCP server giving LLMs access to ~8,200 detection rules across Sigma, Splunk ESCU, Elastic, KQL, Sublime and CrowdStrike formats plus MITRE ATT&CK STIX data for coverage and gap analysis.
Overview
MCP server giving LLMs access to ~8,200 detection rules across Sigma, Splunk ESCU, Elastic, KQL, Sublime and CrowdStrike formats plus MITRE ATT&CK STIX data for coverage and gap analysis.
Best Fit
security-detections-mcp is best suited for teams evaluating MCP integrations, developers exploring TypeScript-based tooling, and operators who want a fast way to assess external AI workflow capabilities.
Operational Notes
This profile is generated from the captured MCP service dataset. It focuses on reliable comparison context, installation readiness, and the core value of security-detections-mcp.
Key Features
Protocol-ready integration
security-detections-mcp is positioned as an MCP-compatible service that can be connected into assistant workflows with a standardized tool interface.
Developer-friendly setup
The service appears in the captured MCP catalog with a primary stack of TypeScript, making it easier to evaluate from an implementation perspective.
Workflow acceleration
This service is designed to reduce friction in AI-assisted tasks by exposing targeted capabilities through the Model Context Protocol.
Advantages
- Provides a focused MCP integration surface for security-detections-mcp.
- Easy to compare against other MCP services in the catalog.
- Useful for teams working with TypeScript tooling and automation workflows.
Trade offs
- Captured source content may omit deep implementation details.
- Production usage still requires reviewing trust, credentials, and operational boundaries.
Use Cases
Evaluation and shortlist building
Use this page to understand whether security-detections-mcp fits your MCP stack before deeper technical adoption.
Assistant workflow integration
Teams can review security-detections-mcp as a candidate tool for expanding agent capabilities in real product or research workflows.
FAQ
What does security-detections-mcp help with?
security-detections-mcp exposes a focused capability through MCP so assistants and AI workflows can interact with that capability in a more structured way.
How should I evaluate it?
Start with the summary, review the install snippet if available, inspect the tools it exposes, and confirm whether its trust model fits your environment.
Install
Copy the configuration below into your MCP client.
{
"mcpServers": {
"security-detections": {
"command": "npx",
"args": ["-y", "security-detections-mcp"],
"env": {
"SIGMA_PATHS": "/path/to/sigma/rules,/path/to/sigma/rules-threat-hunting",
"SPLUNK_PATHS": "/path/to/security_content/detections",
"ELASTIC_PATHS": "/path/to/detection-rules/rules",
"STORY_PATHS": "/path/to/security_content/stories",
"KQL_PATHS": "/path/to/Hunting-Queries-Detection-Rules"
}
}
}
}
{
"mcpServers": {
"security-detections": {
"command": "npx",
"args": ["-y", "security-detections-mcp"],
"env": {
"SIGMA_PATHS": "/Users/you/sigma/rules,/Users/you/sigma/rules-threat-hunting",
"SPLUNK_PATHS": "/Users/you/security_content/detections",
"ELASTIC_PATHS": "/Users/you/detection-rules/rules",
"STORY_PATHS": "/Users/you/security_content/stories",
"KQL_PATHS": "/Users/you/Hunting-Queries-Detection-Rules"
}
}
}
}
{
"mcpServers": {
"security-detections": {
"command": "npx",
"args": ["-y", "security-detections-mcp"],
"env": {
"SIGMA_PATHS": "/path/to/sigma/rules",
"SPLUNK_PATHS": "/path/to/security_content/detections",
"ELASTIC_PATHS": "/path/to/detection-rules/rules",
"KQL_PATHS": "/path/to/kql-hunting-queries"
}
},
"mitre-attack": {
"command": "npx",
"args": ["-y", "mitre-attack-mcp"],
"env": {
"ATTACK_DOMAIN": "enterprise-attack"
}
}
}
}