Security Detections MCP

An MCP (Model Context Protocol) server that lets LLMs query a unified database of Sigma, Splunk ESCU, Elastic, and KQL security detection rules.

Features

• Unified Search - Query Sigma, Splunk ESCU, Elastic, and KQL detections from a single interface
• Full-Text Search - SQLite FTS5 powered search across names, descriptions, queries, MITRE tactics, CVEs, process names, and more
• MITRE ATT&CK Mapping - Filter detections by technique ID or tactic
• CVE Coverage - Find detections for specific CVE vulnerabilities
• Process Name Search - Find detections that reference specific processes (e.g., powershell.exe, w3wp.exe)
• Analytic Stories - Query by Splunk analytic story (optional - enhances context)
• KQL Categories - Filter KQL queries by category (Defender For Endpoint, Azure AD, Threat Hunting, etc.)
• Auto-Indexing - Automatically indexes detections on startup from configured paths
• Multi-Format Support - YAML (Sigma, Splunk), TOML (Elastic), Markdown (KQL)
• Logsource Filtering - Filter Sigma rules by category, product, or service
• Severity Filtering - Filter by criticality level

Quick Start

Option 1: npx (Recommended)

No installation required - just configure and run:

npx -y security-detections-mcp

Option 2: Clone and Build

git clone https://github.com/MHaggis/Security-Detections-MCP.git
cd Security-Detections-MCP
npm install
npm run build

Configuration

Cursor IDE

Add to your MCP config (~/.cursor/mcp.json or .cursor/mcp.json in your project):

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": ["-y", "security-detections-mcp"],
      "env": {
        "SIGMA_PATHS": "/path/to/sigma/rules,/path/to/sigma/rules-threat-hunting",
        "SPLUNK_PATHS": "/path/to/security_content/detections",
        "ELASTIC_PATHS": "/path/to/detection-rules/rules",
        "STORY_PATHS": "/path/to/security_content/stories",
        "KQL_PATHS": "/path/to/Hunting-Queries-Detection-Rules"
      }
    }
  }
}

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": ["-y", "security-detections-mcp"],
      "env": {
        "SIGMA_PATHS": "/Users/you/sigma/rules,/Users/you/sigma/rules-threat-hunting",
        "SPLUNK_PATHS": "/Users/you/security_content/detections",
        "ELASTIC_PATHS": "/Users/you/detection-rules/rules",
        "STORY_PATHS": "/Users/you/security_content/stories",
        "KQL_PATHS": "/Users/you/Hunting-Queries-Detection-Rules"
      }
    }
  }
}

Environment Variables

Variable	Description	Required
SIGMA_PATHS	Comma-separated paths to Sigma rule directories	At least one source required
SPLUNK_PATHS	Comma-separated paths to Splunk ESCU detection directories	At least one source required
ELASTIC_PATHS	Comma-separated paths to Elastic detection rule directories	At least one source required
KQL_PATHS	Comma-separated paths to KQL hunting query directories	At least one source required
STORY_PATHS	Comma-separated paths to Splunk analytic story directories	No (enhances context)

Getting Detection Content

Quick Start: Download All Rules (Copy & Paste)

Create a detections folder and download all sources with sparse checkout (only downloads the rules, not full repos):

# Create detections directory
mkdir -p detections && cd detections

# Download Sigma rules (~3,000+ rules)
git clone --depth 1 --filter=blob:none --sparse https://github.com/SigmaHQ/sigma.git
cd sigma && git sparse-checkout set rules rules-threat-hunting && cd ..

# Download Splunk ESCU detections + stories (~2,000+ detections, ~330 stories)
git clone --depth 1 --filter=blob:none --sparse https://github.com/splunk/security_content.git
cd security_content && git sparse-checkout set detections stories && cd ..

# Download Elastic detection rules (~1,500+ rules)
git clone --depth 1 --filter=blob:none --sparse https://github.com/elastic/detection-rules.git
cd detection-rules && git sparse-checkout set rules && cd ..

# Download KQL hunting queries (~400+ queries from 2 repos)
git clone --depth 1 https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules.git kql-bertjanp
git clone --depth 1 https://github.com/jkerai1/KQL-Queries.git kql-jkerai1

echo "Done! Configure your MCP with these paths:"
echo "  SIGMA_PATHS: $(pwd)/sigma/rules,$(pwd)/sigma/rules-threat-hunting"
echo "  SPLUNK_PATHS: $(pwd)/security_content/detections"
echo "  ELASTIC_PATHS: $(pwd)/detection-rules/rules"
echo "  KQL_PATHS: $(pwd)/kql-bertjanp,$(pwd)/kql-jkerai1"
echo "  STORY_PATHS: $(pwd)/security_content/stories"

Alternative: Full Clone

If you prefer full git history:

# Sigma Rules
git clone https://github.com/SigmaHQ/sigma.git
# Use rules/ and rules-threat-hunting/ directories

# Splunk ESCU
git clone https://github.com/splunk/security_content.git
# Use detections/ and stories/ directories

# Elastic Detection Rules
git clone https://github.com/elastic/detection-rules.git
# Use rules/ directory

# KQL Hunting Queries (multiple sources supported)
git clone https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules.git
git clone https://github.com/jkerai1/KQL-Queries.git
# Use entire repos, combine paths with comma

MCP Tools

Core Detection Tools

Tool	Description
search(query, limit)	Full-text search across all detection fields (names, descriptions, queries, CVEs, process names, etc.)
get_by_id(id)	Get a single detection by its ID
list_all(limit, offset)	Paginated list of all detections
list_by_source(source_type)	Filter by sigma, splunk_escu, elastic, or kql
get_raw_yaml(id)	Get the original YAML/TOML/Markdown content
get_stats()	Get index statistics
rebuild_index()	Force re-index from configured paths

MITRE ATT&CK Filters

Tool	Description
list_by_mitre(technique_id)	Filter by MITRE ATT&CK technique ID (e.g., T1059.001)
list_by_mitre_tactic(tactic)	Filter by tactic (execution, persistence, credential-access, etc.)

Vulnerability & Process Filters

Tool	Description
list_by_cve(cve_id)	Find detections for a specific CVE (e.g., CVE-2024-27198)
list_by_process_name(process_name)	Find detections referencing a process (e.g., powershell.exe, w3wp.exe)
list_by_data_source(data_source)	Filter by data source (e.g., Sysmon, Windows Security)

Classification Filters

Tool	Description
list_by_logsource(category, product, service)	Filter Sigma rules by logsource
list_by_severity(level)	Filter by severity (informational/low/medium/high/critical)
list_by_detection_type(type)	Filter by type (TTP, Anomaly, Hunting, Correlation)
list_by_analytic_story(story)	Filter by Splunk analytic story

KQL-Specific Filters

Tool	Description
list_by_kql_category(category)	Filter KQL by category (e.g., "Defender For Endpoint", "Azure Active Directory", "Threat Hunting")
list_by_kql_tag(tag)	Filter KQL by tag (e.g., "ransomware", "hunting", "ti-feed", "dfir")
list_by_kql_datasource(data_source)	Filter KQL by Microsoft data source (e.g., "DeviceProcessEvents", "SigninLogs")

Story Tools (Optional)

Tool	Description
search_stories(query, limit)	Search analytic stories by narrative and description
get_story(name)	Get detailed story information
list_stories(limit, offset)	List all analytic stories
list_stories_by_category(category)	Filter stories by category (Malware, Adversary Tactics, etc.)

Efficient Analysis Tools (Token-Optimized)

These tools do heavy processing server-side and return minimal, actionable data:

Tool	Description	Output Size
analyze_coverage(source_type?)	Get coverage stats by tactic, top techniques, weak spots	~2KB
identify_gaps(threat_profile, source_type?)	Find gaps for ransomware, apt, persistence, etc.	~500B
suggest_detections(technique_id, source_type?)	Get detection ideas for a technique	~2KB
get_technique_ids(source_type?, tactic?, severity?)	Get only technique IDs (no full objects)	~200B
generate_navigator_layer(name, source_type?, tactic?)	Generate ATT&CK Navigator layer JSON	~3KB

Why use these? Traditional tools return full detection objects (~50KB+ per query). These return only what you need, saving 25x+ tokens.

Claude Code Skills

This repo includes Claude Code Skills in .claude/skills/ that teach Claude efficient workflows:

Skill	Purpose
coverage-analysis	Efficient coverage analysis using the token-optimized tools

Why skills? Instead of figuring out methodology each time (wasting tokens), skills teach Claude once.

You can also install personal skills to ~/.claude/skills/ for cross-project use.

Example: Efficient Coverage Analysis

You: "What's my Elastic coverage against ransomware?"

AI uses skills + efficient tools:
1. analyze_coverage(source_type="elastic")     → Stats by tactic
2. identify_gaps(threat_profile="ransomware")  → Prioritized gaps
3. suggest_detections(technique_id="T1486")    → Fix top gap

Total: ~5KB of data vs ~500KB with traditional tools

Example Workflows

Find PowerShell Detections

LLM: "Find me PowerShell detections related to base64 encoding"
Tool: search(query="powershell base64", limit=5)

Check CVE Coverage

LLM: "Do we have detections for CVE-2024-27198?"
Tool: list_by_cve(cve_id="CVE-2024-27198")

Compare Coverage Across Sources

LLM: "What detections do we have for credential dumping?"
Tool: search(query="credential dumping", limit=10)
→ Returns results from Sigma, Splunk, Elastic, AND KQL

Find Web Server Attack Detections

LLM: "What detections cover IIS web server attacks?"
Tool: list_by_process_name(process_name="w3wp.exe")

Explore a Threat Campaign

LLM: "Tell me about ransomware detections"
Tool: search_stories(query="ransomware")
Tool: list_by_analytic_story(story="Ransomware")

Find KQL Hunting Queries for Defender

LLM: "What KQL queries do we have for Defender For Endpoint?"
Tool: list_by_kql_category(category="Defender For Endpoint")

Search for BloodHound Detections

LLM: "Find detections for BloodHound usage"
Tool: search(query="bloodhound", limit=10)
→ Returns KQL hunting queries and other source detections

Unified Schema

All detection sources (Sigma, Splunk, Elastic, KQL) are normalized to a common schema:

Core Fields

Field	Description
id	Unique identifier
name	Detection name/title
description	What the detection looks for
query	Detection logic (Sigma YAML, Splunk SPL, Elastic EQL, or KQL)
source_type	sigma, splunk_escu, elastic, or kql
severity	Detection severity level
status	Rule status (stable, test, experimental, production, etc.)
author	Rule author
file_path	Original file path
raw_yaml	Original YAML/TOML/Markdown content

Enhanced Fields (for Semantic Search)

Field	Description
mitre_ids	Mapped MITRE ATT&CK technique IDs
mitre_tactics	Extracted MITRE tactics (execution, persistence, etc.)
cves	CVE identifiers (e.g., CVE-2024-27198)
analytic_stories	Splunk analytic story names
process_names	Process names referenced in detection
file_paths	Interesting file paths referenced
registry_paths	Registry paths referenced
data_sources	Required data sources (Sysmon, DeviceProcessEvents, etc.)
detection_type	TTP, Anomaly, Hunting, or Correlation
asset_type	Endpoint, Web Server, Cloud, Network
security_domain	endpoint, network, cloud, access

KQL-Specific Fields

Field	Description
kql_category	Category derived from folder path (e.g., "Defender For Endpoint")
kql_tags	Extracted tags (e.g., "ransomware", "hunting", "ti-feed")
kql_keywords	Security keywords extracted for search
platforms	Platforms (windows, azure-ad, office-365, etc.)

Database

The index is stored at ~/.cache/security-detections-mcp/detections.sqlite.

• Auto-created on first run
• Auto-indexed when paths are configured
• Use rebuild_index() to refresh after updating detection repos

Supported Detection Formats

Sigma Rules (YAML)

Based on the official Sigma specification:

• All required fields: title, logsource, detection
• All optional fields: id, status, description, author, date, modified, references, tags, level, falsepositives, etc.
• CVE tags extracted from tags field (e.g., cve.2021-1675)

Splunk ESCU (YAML)

From Splunk Security Content:

• Required: name, id, search
• Optional: description, author, date, status, references, tags (including mitre_attack_id, analytic_story, cve)

Splunk Analytic Stories (YAML - Optional)

From Splunk Security Content stories:

• Provides rich narrative context for threat campaigns
• Enhances semantic search with detailed descriptions
• Links detections to broader threat context

Elastic Detection Rules (TOML)

From Elastic Detection Rules:

• Required: rule.name, rule.rule_id
• Optional: rule.description, rule.query, rule.severity, rule.tags, rule.threat (MITRE mappings)
• Supports EQL, KQL, Lucene, and ESQL query languages

KQL Hunting Queries (Markdown & Raw .kql)

Supports multiple KQL repositories:

Bert-JanP/Hunting-Queries-Detection-Rules (~290 queries)

• Microsoft Defender XDR and Azure Sentinel hunting queries in Markdown format
• Extracts title from markdown heading, KQL from fenced code blocks
• Extracts MITRE technique IDs from tables
• Categories: Defender For Endpoint, Azure AD, Threat Hunting, DFIR, etc.

jkerai1/KQL-Queries (~130 queries)

• Raw .kql files for Defender, Entra, Azure, Office 365
• Title derived from filename
• Lightweight queries for kqlsearch.com

Development

# Install dependencies
npm install

# Build
npm run build

# Run with paths
SIGMA_PATHS="./detections/sigma/rules" \
SPLUNK_PATHS="./detections/splunk/detections" \
ELASTIC_PATHS="./detections/elastic/rules" \
KQL_PATHS="./detections/kql" \
STORY_PATHS="./detections/splunk/stories" \
npm start

Stats (with full content)

When fully indexed with all sources:

Source	Count
Sigma Rules	~3,000+
Splunk ESCU	~2,000+
Elastic Rules	~1,500+
KQL Queries	~420+
Analytic Stories	~330
Total	~7,200+

🔗 Using with MITRE ATT&CK MCP

This MCP pairs perfectly with mitre-attack-mcp for complete threat coverage analysis:

MCP	Purpose
security-detections-mcp	Query 7,200+ detection rules (Sigma, Splunk ESCU, Elastic, KQL)
mitre-attack-mcp	Analyze coverage against ATT&CK framework, generate Navigator layers

Combined Workflow (Efficient)

You: "What's my coverage against APT29?"

LLM workflow (3 calls, ~10KB total):
1. mitre-attack-mcp → get_group_techniques("G0016")     # APT29's TTPs
2. detections-mcp → analyze_coverage(source_type="elastic")  # Your coverage
3. mitre-attack-mcp → find_group_gaps("G0016", your_coverage) # The gaps

Result: Prioritized gap list, not 500KB of raw data

Generate Navigator Layer (1 call)

You: "Generate a Navigator layer for my initial access coverage"

LLM: generate_navigator_layer(
  name="Initial Access Coverage",
  source_type="elastic",
  tactic="initial-access"
)

→ Returns ready-to-import Navigator JSON

Install Both Together

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": ["-y", "security-detections-mcp"],
      "env": {
        "SIGMA_PATHS": "/path/to/sigma/rules",
        "SPLUNK_PATHS": "/path/to/security_content/detections",
        "ELASTIC_PATHS": "/path/to/detection-rules/rules",
        "KQL_PATHS": "/path/to/kql-hunting-queries"
      }
    },
    "mitre-attack": {
      "command": "npx",
      "args": ["-y", "mitre-attack-mcp"],
      "env": {
        "ATTACK_DOMAIN": "enterprise-attack"
      }
    }
  }
}

License

Apache 2.0