Security Detections

Full-text search across all detection fields (name, description, query, MITRE IDs, tags, CVEs, analytic stories, process names, file paths, registry paths)

Get a single detection by its ID

Get the original YAML content for a detection

List all detections with pagination. Use for browsing the detection index.

List detections filtered by source type

List detections that map to a specific MITRE ATT&CK technique

List Sigma detections filtered by logsource (category, product, or service)

List detections filtered by severity level

List detections that cover a specific CVE vulnerability

List Splunk detections that belong to a specific analytic story (e.g., "Ransomware", "Data Destruction")

List detections that reference a specific process name (e.g., "powershell.exe", "w3wp.exe", "cmd.exe")

List detections by type (TTP, Anomaly, Hunting, Correlation)

List detections that use a specific data source (e.g., "Sysmon", "Windows Security", "process_creation")

List detections by MITRE ATT&CK tactic (e.g., "execution", "persistence", "credential-access")

List KQL detections filtered by category (e.g., "Defender For Endpoint", "Azure Active Directory", "Threat Hunting")

List KQL detections filtered by tag (e.g., "ransomware", "hunting", "ti-feed")

List KQL detections that use a specific Microsoft data source (e.g., "DeviceProcessEvents", "SigninLogs", "EmailEvents")

Get statistics about the indexed detections and stories

Takes no parameters.

Get ONLY unique MITRE technique IDs (lightweight - no full detection data). Use this for Navigator layer generation or coverage analysis.

Get coverage analysis with stats by tactic, top covered techniques, and weak spots. Returns summary data, not raw detections. Use this instead of listing detections and processing manually.

Identify detection gaps based on a threat profile (ransomware, apt, initial-access, persistence, credential-access, defense-evasion). Returns prioritized gaps with recommendations.

Get detection suggestions for a specific technique. Returns existing detections, required data sources, and detection ideas.

Generate a MITRE ATT&CK Navigator layer JSON from detection coverage. Returns valid Navigator JSON ready for import at https://mitre-attack.github.io/attack-navigator/. Filter by source, tactic, or severity.

Analyze procedure-level coverage for a MITRE technique. Goes beyond "we cover T1059.001" to show WHICH specific behaviors/procedures your detections actually catch (e.g., encoded commands, download cradles, AMSI bypass). Shows covered and uncovered procedures with detection names.

Compare procedure-level detection coverage across sources for a technique. Shows which source catches which specific behaviors — two orgs can both tag T1059.001 but detect completely different procedures. Returns a matrix of source × procedure.

Get a lightweight list of detection names and IDs matching a search query. Returns ONLY name, id, source, mitre_ids - no queries or raw yaml. Use this when you need a simple list.

Compare detection coverage between sources (Sigma vs Splunk vs Elastic vs KQL) for a topic. Returns a clean breakdown with counts and names per source.

Get quick counts of detections by source for a topic. Returns just the numbers, no detection details.

List detections whose NAME matches a pattern, grouped by source. Returns just name + ID pairs.

Compare detections across sources, tactics, or techniques for a given topic. Returns breakdown by source, tactic, and severity.

Get a lightweight coverage summary (~200 bytes) with tactic percentages. Use this for quick overviews instead of full analyze_coverage.

Get just the top 5 gaps (~300 bytes) for a threat profile. Use this for quick gap checks.

Get just the detection count for a technique (~50 bytes). Use this for quick coverage checks.

Analyze detection coverage against a specific threat actor. Shows which of the actor's known MITRE ATT&CK techniques have detections, coverage percentage, and prioritized gaps. Requires STIX data (ATTACK_STIX_PATH env var).

List all known MITRE ATT&CK threat actors with aliases and technique counts. Requires STIX data (ATTACK_STIX_PATH env var).

Compare detection coverage across multiple threat actors. Shows shared technique gaps and unique risks per actor. Requires STIX data (ATTACK_STIX_PATH env var).

Get full threat actor dossier: description, aliases, known techniques, software employed, and detection coverage status. Requires STIX data (ATTACK_STIX_PATH env var).

Search analytic stories by narrative, description, or name. Stories provide rich context about threat campaigns and detection strategies.

Get detailed information about a specific analytic story by name

List all analytic stories with pagination

List analytic stories by category (e.g., "Malware", "Adversary Tactics", "Abuse")

Save a query result for quick retrieval later. Useful for caching frequently needed data.

Retrieve a previously saved query result by name.

List all saved queries, optionally filtered by type.

Force re-index all detections and stories from configured paths. WARNING: This is a destructive operation that deletes the current index.

Save a reusable query template with {{placeholders}}. Templates can contain SQL queries or tool-chain definitions for future execution.

Execute a saved query template with the provided parameters. Returns the query results.

List all saved query templates with their names, descriptions, and usage statistics.

Get the full details of a saved query template including the template string and parameters.

Delete a saved query template by name.

Create a new custom table to store analysis data. Use this to persist findings, research results, or any structured data you want to retrieve later. Pre-built tables available: gap_analyses, source_comparisons, threat_actor_profiles, detection_recommendations

Insert a row of data into a dynamic table. Data is validated against the table schema.

Query data from a dynamic table with optional filtering, sorting, and pagination. Filter examples: - Exact match: {"status": "completed"} - LIKE match: {"name": "%ransomware%"} - Multiple conditions: {"status": "pending", "priority": "high"}

List all dynamic tables created by the LLM, including pre-built analysis tables and their statistics.

Remove a dynamic table and all its data. Use with caution - this is irreversible.

Get detailed schema information and statistics for a dynamic table.

Create a knowledge entity representing a security concept. Use this to build the knowledge graph with threat actors, techniques, detections, campaigns, tools, vulnerabilities, and data sources. Entity types: - threat_actor: APT groups, criminal gangs (e.g., "APT29", "STORM-0501") - technique: MITRE ATT&CK techniques (e.g., "T1059.001 PowerShell") - detection: Security detection rules (e.g., "Suspicious PowerShell Execution") - campaign: Attack campaigns (e.g., "SolarWinds Compromise") - tool: Attack tools or malware (e.g., "Cobalt Strike", "Mimikatz") - vulnerability: CVEs (e.g., "CVE-2024-1234") - data_source: Log sources (e.g., "Windows Security Events")

Create a relationship between two entities WITH reasoning explaining WHY they're connected. This is the core of tribal knowledge - capturing not just the connection but the insight behind it. Relation types: - uses: Threat actor uses technique/tool (e.g., APT29 uses Cobalt Strike) - targets: Threat actor targets sector/system - detects: Detection covers technique - covers: Detection provides coverage for technique - mitigates: Control mitigates technique - exploits: Campaign exploits vulnerability - attributed_to: Campaign attributed to threat actor - depends_on: Detection depends on data source - related_to: General relationship IMPORTANT: The reasoning field is critical - explain WHY this connection exists.

Add a fact or observation about an entity. Observations capture point-in-time knowledge that can be queried later. Examples: - "APT29 has been active since at least 2008" - "This detection has high false positives in development environments" - "T1059.001 is commonly used for initial access in ransomware"

Remove an entity from the knowledge graph. This also removes all relations and observations associated with the entity.

Remove a specific observation by its ID. Use open_entity first to find observation IDs.

Search across all knowledge types: entities, relations, observations, decisions, and learnings. Uses full-text search to find relevant tribal knowledge. Search examples: - "PowerShell execution" - Find everything related to PowerShell - "credential theft" - Find credential-related knowledge - "APT29" - Find all knowledge about this threat actor

Read the entire knowledge graph or a filtered subgraph. Returns entities, relations, and observations. Use this to: - Get an overview of all stored knowledge - Filter by entity type to focus on specific concepts - Understand the structure of captured tribal knowledge

Get complete information about a specific entity including all its relations and observations. This is the detailed view of a single knowledge node.

Record WHY a significant decision was made. This is the gold of tribal knowledge - capturing the reasoning process so future agents can understand past decisions. Decision types: - gap_identified: A detection gap was found - detection_recommended: A specific detection was recommended - coverage_mapped: Coverage was analyzed and mapped - priority_assigned: A priority decision was made - false_positive_tuning: FP tuning recommendation - threat_assessment: Threat level assessment - data_source_selected: Data source was chosen IMPORTANT: Be detailed in the reasoning - this helps future analysis.

Store a pattern or insight derived from analysis for future reference. Learnings are reusable knowledge that can help future sessions. Learning types: - detection_pattern: A pattern for writing effective detections - gap_pattern: A recurring type of detection gap - user_preference: User preferences for analysis style - false_positive_pattern: Common FP patterns to avoid - threat_pattern: Recurring threat behaviors - correlation_insight: Insights about technique correlations - data_quality_insight: Insights about data source quality Examples: - "STORM-0501 consistently uses native tools before deploying ransomware" - "Detections for T1059.001 need process parent filtering to reduce FPs" - "User prefers prioritizing detections by MITRE tactic stage"

Get past decisions relevant to the current context. Uses full-text search to find tribal knowledge that applies to your current analysis. Use this to: - See how similar situations were handled before - Understand reasoning behind past recommendations - Maintain consistency with previous decisions

Get applicable learnings for the current task. Returns patterns and insights that may help with the current analysis. Use this to: - Apply proven patterns to new situations - Remember user preferences - Avoid known pitfalls

Automatically analyze detection coverage, identify gaps across threat profiles, and store findings for future reference. This tool: 1. Runs coverage analysis across all detections 2. Identifies gaps for specified threat profiles (ransomware, apt, etc.) 3. Stores results in the gap_analyses dynamic table 4. Logs decisions about significant findings in the knowledge graph Use this for comprehensive, stored analysis that persists across sessions.

Generate a comprehensive gap report comparing detection coverage across sources (Sigma, Splunk ESCU, Elastic, KQL) and threat profiles. This tool: 1. Analyzes all threat profiles for gaps 2. Compares detection coverage across different sources 3. Creates prioritized recommendations based on severity and coverage 4. Stores the complete report in dynamic tables Use this for executive-level reporting on detection posture.

Autonomously compare detection coverage across different sources (Sigma, Splunk ESCU, Elastic, KQL) with detailed reasoning and analysis. This tool: 1. Compares detection counts and coverage across all available sources 2. Analyzes technique-level coverage differences between sources 3. Identifies which source has best coverage for specific tactics/techniques 4. Provides reasoned recommendations for source selection 5. Stores comparison results and logs decision reasoning Use this to understand the strengths/weaknesses of different detection sources and make informed decisions about which to use.

Request LLM-enhanced analysis of security detection data using MCP sampling. This tool leverages MCP sampling to request the client's LLM to analyze security data with expert reasoning. Unlike the auto_* tools that perform direct analysis, this tool asks the LLM to provide contextual insights. Note: Requires client to support MCP sampling capability. If not supported, falls back to structured data output. Use cases: - Get expert reasoning about coverage gaps - Generate detection recommendations with context - Compare sources with nuanced analysis - Understand threat profile implications

Check if MCP sampling is available for LLM-enhanced analysis. Sampling allows the server to request LLM completions from the client, enabling richer autonomous analysis. Not all MCP clients support this feature. Use this tool to check capability before using llm_enhanced_analysis.

Takes no parameters.

Get common query patterns for a MITRE technique based on existing detections. Returns SPL structure, common fields, macros used, and example queries. Use this before writing a detection to learn the conventions.

Get available fields for a Splunk data model with usage examples. Use this to understand what fields are available when writing a detection query.

Get common Splunk macros and their usage patterns. Essential for writing detections that follow repository conventions.

Find existing detections similar to what you want to create. Use this to learn from existing detection logic and structure.

Generate a detection template based on technique, learned patterns, and conventions. Returns YAML structure ready for customization.

Generate RBA (Risk-Based Alerting) structure for a detection based on learned patterns and best practices.

Extract and store patterns from all indexed detections. Run this to populate the pattern database for template generation.

Store user preference or correction to improve future suggestions. Call this when user modifies generated content to build tribal knowledge.