Security Detections

Local install

io.github.MHaggis/security-detections-mcpv3.3.4 GitHub verified

Search security detections across Sigma, Splunk, Elastic, KQL, Sublime, CQL and Jamf with ATT&CK.

Security

Watch Source

Registry entry

Open in the registry

{
  "_meta": {
    "io.modelcontextprotocol.registry/official": {
      "status": "active",
      "isLatest": true,
      "updatedAt": "2026-11-04T19:19:18.78265Z",
      "publishedAt": "2026-11-04T19:19:18.78265Z",
      "statusChangedAt": "2026-11-04T19:19:18.78265Z"
    }
  },
  "server": {
    "name": "io.github.MHaggis/security-detections-mcp",
    "title": "Security Detections",
    "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
    "version": "3.3.4",
    "packages": [
      {
        "version": "3.3.4",
        "transport": {
          "type": "stdio"
        },
        "identifier": "security-detections-mcp",
        "runtimeHint": "npx",
        "registryType": "npm",
        "registryBaseUrl": "https://registry.npmjs.org",
        "environmentVariables": [
          {
            "name": "SIGMA_PATHS",
            "description": "Comma-separated paths to Sigma rule directories (e.g., /path/to/sigma/rules,/path/to/sigma/rules-threat-hunting)"
          },
          {
            "name": "SPLUNK_PATHS",
            "description": "Comma-separated paths to Splunk ESCU detection directories (e.g., /path/to/security_content/detections)"
          },
          {
            "name": "ELASTIC_PATHS",
            "description": "Comma-separated paths to Elastic detection rule directories (e.g., /path/to/detection-rules/rules)"
          },
          {
            "name": "KQL_PATHS",
            "description": "Comma-separated paths to KQL hunting query directories (e.g., /path/to/kql-queries)"
          },
          {
            "name": "SUBLIME_PATHS",
            "description": "Comma-separated paths to Sublime MQL rule directories (e.g., /path/to/sublime-rules/detection-rules,/path/to/delivr-detections/sublime-rules)"
          },
          {
            "name": "CQL_HUB_PATHS",
            "description": "Comma-separated paths to CQL Hub (CrowdStrike) query directories (e.g., /path/to/cql-hub/queries)"
          },
          {
            "name": "JAMF_PROTECT_PATHS",
            "description": "Comma-separated paths to Jamf Protect custom analytic detection directories (macOS, e.g., /path/to/jamfprotect/custom_analytic_detections)"
          },
          {
            "name": "STORY_PATHS",
            "description": "Comma-separated paths to Splunk analytic story directories (optional, e.g., /path/to/security_content/stories)"
          }
        ]
      }
    ],
    "repository": {
      "url": "https://github.com/MHaggis/Security-Detections-MCP",
      "source": "github"
    },
    "description": "Search security detections across Sigma, Splunk, Elastic, KQL, Sublime, CQL and Jamf with ATT&CK."
  }
}

Maintain this server? Claim it

Try it

This server only runs locally, from a package. Install it with the instructions on this page to try it.

Install

Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.

One click: Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Run in a terminal

claude mcp add security-detections-mcp \
  -- npx -y [email protected]

Environment

SIGMA_PATHS (optional, not in the config above): Comma-separated paths to Sigma rule directories (e.g., /path/to/sigma/rules,/path/to/sigma/rules-threat-hunting)
SPLUNK_PATHS (optional, not in the config above): Comma-separated paths to Splunk ESCU detection directories (e.g., /path/to/security_content/detections)
ELASTIC_PATHS (optional, not in the config above): Comma-separated paths to Elastic detection rule directories (e.g., /path/to/detection-rules/rules)
KQL_PATHS (optional, not in the config above): Comma-separated paths to KQL hunting query directories (e.g., /path/to/kql-queries)
SUBLIME_PATHS (optional, not in the config above): Comma-separated paths to Sublime MQL rule directories (e.g., /path/to/sublime-rules/detection-rules,/path/to/delivr-detections/sublime-rules)
CQL_HUB_PATHS (optional, not in the config above): Comma-separated paths to CQL Hub (CrowdStrike) query directories (e.g., /path/to/cql-hub/queries)
JAMF_PROTECT_PATHS (optional, not in the config above): Comma-separated paths to Jamf Protect custom analytic detection directories (macOS, e.g., /path/to/jamfprotect/custom_analytic_detections)
STORY_PATHS (optional, not in the config above): Comma-separated paths to Splunk analytic story directories (optional, e.g., /path/to/security_content/stories)

Tools

We don't run packages, so we can't list this server's tools.

Install

Pick your client. Values in capitals, like YOUR_TOKEN, are yours to fill in.

One click: Add to Cursor Add to VS Code Add to LM Studio Add to Goose

Run in a terminal

claude mcp add security-detections-mcp \
  -- npx -y [email protected]

Environment

SIGMA_PATHS (optional, not in the config above): Comma-separated paths to Sigma rule directories (e.g., /path/to/sigma/rules,/path/to/sigma/rules-threat-hunting)
SPLUNK_PATHS (optional, not in the config above): Comma-separated paths to Splunk ESCU detection directories (e.g., /path/to/security_content/detections)
ELASTIC_PATHS (optional, not in the config above): Comma-separated paths to Elastic detection rule directories (e.g., /path/to/detection-rules/rules)
KQL_PATHS (optional, not in the config above): Comma-separated paths to KQL hunting query directories (e.g., /path/to/kql-queries)
SUBLIME_PATHS (optional, not in the config above): Comma-separated paths to Sublime MQL rule directories (e.g., /path/to/sublime-rules/detection-rules,/path/to/delivr-detections/sublime-rules)
CQL_HUB_PATHS (optional, not in the config above): Comma-separated paths to CQL Hub (CrowdStrike) query directories (e.g., /path/to/cql-hub/queries)
JAMF_PROTECT_PATHS (optional, not in the config above): Comma-separated paths to Jamf Protect custom analytic detection directories (macOS, e.g., /path/to/jamfprotect/custom_analytic_detections)
STORY_PATHS (optional, not in the config above): Comma-separated paths to Splunk analytic story directories (optional, e.g., /path/to/security_content/stories)

Try it

Install

Tools

Try it

Install

Tools

How it ranks