Security Detections Mcp

reason-machines/security-skills/skills/security-detections-mcp

作者 reason-machines304c245fe992無授權條款11 個星標收錄於 2026年10月9日更新於 2026年10月9日儲存庫2 個月前更新

Query unified Sigma, Splunk, Elastic, KQL, Sublime, and CrowdStrike security detection rules via MCP server with MITRE ATT&CK mapping and coverage analysis

僅含說明SecurityAI & Agents
AI 產生的概覽

用於搜尋與分析安全偵測規則並對應 MITRE ATT&CK 涵蓋範圍的 MCP 伺服器技能。

功能
此技能說明一個 MCP 伺服器，可索引並查詢來自 Sigma、Splunk ESCU、Elastic、KQL、Sublime 與 CrowdStrike CQL 的安全偵測規則。它支援全文搜尋，並可依 MITRE ATT&CK 技術、戰術、CVE、處理程序名稱、嚴重性與資料來源進行篩選，同時提供涵蓋範圍分析與缺口識別。它也能產生 ATT&CK Navigator 圖層 JSON，並以原生格式匯出偵測規則。
適用情境
當您需要尋找涵蓋特定技術的偵測規則、評估 MITRE ATT&CK 涵蓋情形、識別針對某威脅輪廓或攻擊者的偵測缺口，或比較不同平台的涵蓋範圍時，可使用此技能。它也適合用於建置或驗證偵測內容等偵測工程任務。
執行需求
需要 Node.js 18+ 以及本機複製的偵測規則儲存庫，或使用託管 API 權杖以達成零設定。環境變數需指向 Sigma、Splunk、Elastic、KQL、Sublime、CQL Hub 與 MITRE ATT&CK STIX 路徑。複製儲存庫或存取託管端點需要網路存取。此技能未隨附指令碼，僅為說明文件。

security-detections-mcp

Skill by ara.so — Security Skills collection

An MCP (Model Context Protocol) server providing LLM access to 8,200+ security detection rules across Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL formats, with MITRE ATT&CK mapping, coverage analysis, and autonomous detection engineering.

What It Does

  • Unified detection search across 6 major security platforms (Sigma, Splunk, Elastic, KQL, Sublime, CrowdStrike)
  • MITRE ATT&CK integration with 172 threat actors, 784 software, 4,362 actor-technique relationships
  • Coverage analysis identifying gaps in detection by tactic/technique/actor
  • ATT&CK Navigator layers exportable as JSON for visualization
  • Autonomous detection pipeline from CTI ingestion to draft PR generation
  • 81 MCP tools for detection engineering (local) or ~25 tools (hosted)
  • 11 expert prompts for ransomware assessment, APT emulation, purple teaming

Installation

Local Installation (Full Power)

Prerequisites:

  • Node.js 18+
  • Detection rule repositories cloned locally

Quick start with npx:

bash
npx -y security-detections-mcp

Configure in Claude Desktop (claude_desktop_config.json):

json
{  "mcpServers": {    "security-detections": {      "command": "npx",      "args": ["-y", "security-detections-mcp"],      "env": {        "SIGMA_PATHS": "/path/to/sigma/rules,/path/to/sigma/rules-threat-hunting",        "SPLUNK_PATHS": "/path/to/security_content/detections",        "STORY_PATHS": "/path/to/security_content/stories",        "ELASTIC_PATHS": "/path/to/detection-rules/rules",        "KQL_PATHS": "/path/to/kql-rules",        "SUBLIME_PATHS": "/path/to/sublime-rules/detection-rules",        "CQL_HUB_PATHS": "/path/to/cql-hub/queries",        "ATTACK_STIX_PATH": "/path/to/enterprise-attack.json"      }    }  }}

Configure in Cursor (.cursor/settings.json):

json
{  "mcp": {    "servers": {      "security-detections": {        "command": "npx",        "args": ["-y", "security-detections-mcp"],        "env": {          "SIGMA_PATHS": "/Users/you/detections/sigma/rules",          "SPLUNK_PATHS": "/Users/you/detections/security_content/detections"        }      }    }  }}

Configure in VS Code (settings.json):

json
{  "mcp.servers": {    "security-detections": {      "type": "stdio",      "command": "npx",      "args": ["-y", "security-detections-mcp"],      "env": {        "SIGMA_PATHS": "/home/you/detections/sigma/rules"      }    }  }}

Hosted Installation (Zero Setup)

Prerequisites:

Claude Desktop (requires mcp-remote):

json
{  "mcpServers": {    "security-detections": {      "command": "npx",      "args": [        "-y",        "mcp-remote",        "https://detect.michaelhaag.org/api/mcp/mcp",        "--header",        "Authorization: Bearer ${SDMCP_TOKEN}"      ]    }  }}

VS Code / Cursor:

json
{  "mcp.servers": {    "security-detections": {      "type": "http",      "url": "https://detect.michaelhaag.org/api/mcp/mcp",      "headers": {        "Authorization": "Bearer ${SDMCP_TOKEN}"      }    }  }}

Getting Detection Content

Download all detection sources with sparse checkout:

bash
mkdir -p ~/detections && cd ~/detections
# Sigma rulesgit clone --depth 1 --filter=blob:none --sparse https://github.com/SigmaHQ/sigma.gitcd sigma && git sparse-checkout set rules rules-threat-hunting && cd ..
# Splunk ESCUgit clone --depth 1 --filter=blob:none --sparse https://github.com/splunk/security_content.gitcd security_content && git sparse-checkout set detections stories && cd ..
# Elasticgit clone --depth 1 --filter=blob:none --sparse https://github.com/elastic/detection-rules.gitcd detection-rules && git sparse-checkout set rules && cd ..
# KQLgit clone --depth 1 https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules.git kql-bertjanpgit clone --depth 1 https://github.com/jkerai1/KQL-Queries.git kql-jkerai1
# Sublimegit clone --depth 1 --filter=blob:none --sparse https://github.com/sublime-security/sublime-rules.gitcd sublime-rules && git sparse-checkout set detection-rules && cd ..
# CrowdStrike CQLgit clone --depth 1 https://github.com/ByteRay-Labs/Query-Hub.git cql-hub
# MITRE ATT&CK STIXcurl -o enterprise-attack.json https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json

Then update environment variables to point to these paths.

Core MCP Tools

Detection Search & Retrieval

typescript
// Full-text search across all detections{  "name": "search",  "arguments": {    "query": "process injection",    "limit": 10  }}
// Get specific detection by ID{  "name": "get_by_id",  "arguments": {    "id": "sigma_abc123"  }}
// List all detections with pagination{  "name": "list_all",  "arguments": {    "limit": 50,    "offset": 0  }}
// Filter by source type{  "name": "list_by_source",  "arguments": {    "source_type": "sigma"  // sigma, splunk_escu, elastic, kql, sublime, crowdstrike_cql  }}
// Get index statistics{  "name": "get_stats",  "arguments": {}}

MITRE ATT&CK Filtering

typescript
// Find detections for specific technique{  "name": "list_by_mitre",  "arguments": {    "technique_id": "T1059.001"  // PowerShell  }}
// Filter by tactic{  "name": "list_by_mitre_tactic",  "arguments": {    "tactic": "execution"  // execution, persistence, privilege-escalation, etc.  }}
// Search by CVE{  "name": "list_by_cve",  "arguments": {    "cve_id": "CVE-2021-34527"  // PrintNightmare  }}
// Find by process name{  "name": "list_by_process_name",  "arguments": {    "process_name": "powershell.exe"  }}
// Filter by severity{  "name": "list_by_severity",  "arguments": {    "level": "critical"  // critical, high, medium, low  }}
// Filter by data source{  "name": "list_by_data_source",  "arguments": {    "data_source": "process_creation"  }}

Coverage Analysis

typescript
// Analyze overall coverage (~2KB response){  "name": "analyze_coverage",  "arguments": {    "source_type": "sigma"  // optional: analyze specific source  }}
// Identify gaps for threat profile (~500B response){  "name": "identify_gaps",  "arguments": {    "threat_profile": "ransomware"  // ransomware, apt, persistence, lateral_movement  }}
// Get detection suggestions for technique (~2KB){  "name": "suggest_detections",  "arguments": {    "technique_id": "T1003.001"  // LSASS Memory  }}
// Coverage summary by tactic (~200B){  "name": "get_coverage_summary",  "arguments": {    "source_type": "splunk_escu"  }}
// Analyze coverage against threat actor{  "name": "analyze_actor_coverage",  "arguments": {    "actor": "APT29"  }}
// Compare coverage across multiple actors{  "name": "compare_actor_coverage",  "arguments": {    "actors": ["APT29", "APT28", "Lazarus Group"]  }}
// Behavioral procedure breakdown for technique{  "name": "analyze_procedure_coverage",  "arguments": {    "technique_id": "T1055"  }}

ATT&CK Navigator Layer Generation

typescript
// Generate Navigator layer JSON{  "name": "generate_navigator_layer",  "arguments": {    "name": "Current Coverage",    "description": "Detection coverage as of 2024-01",    "filter": {      "source": "sigma",      "tactic": "defense-evasion",      "min_severity": "medium"    },    "color_by": "coverage"  // coverage, severity, source  }}
// Export to file (local only){  "name": "export_navigator_layer",  "arguments": {    "output_path": "./coverage-layer.json",    "filter": {      "actor": "APT29"    }  }}

Common Patterns

Ransomware Readiness Assessment

Use the built-in prompt:

Use the ransomware-readiness-assessment prompt to evaluate our coverage

Or manually:

typescript
// 1. Identify gaps{  "name": "identify_gaps",  "arguments": {    "threat_profile": "ransomware"  }}
// 2. Get detections for weak areas{  "name": "list_by_mitre",  "arguments": {    "technique_id": "T1486"  // Data Encrypted for Impact  }}
// 3. Generate coverage layer{  "name": "generate_navigator_layer",  "arguments": {    "name": "Ransomware Coverage",    "filter": {      "threat_profile": "ransomware"    }  }}

APT Threat Emulation

typescript
// 1. Analyze actor coverage{  "name": "analyze_actor_coverage",  "arguments": {    "actor": "APT29"  }}
// 2. Get techniques used by actor{  "name": "get_actor_techniques",  "arguments": {    "actor": "APT29"  }}
// 3. Find detections for each technique{  "name": "list_by_mitre",  "arguments": {    "technique_id": "T1059.001"  }}
// 4. Compare with other actors{  "name": "compare_actor_coverage",  "arguments": {    "actors": ["APT29", "APT28"]  }}

Detection Gap Analysis

typescript
// 1. Get coverage summary{  "name": "get_coverage_summary",  "arguments": {}}
// 2. Analyze coverage by tactic{  "name": "analyze_coverage",  "arguments": {}}
// 3. Identify specific gaps{  "name": "identify_gaps",  "arguments": {    "threat_profile": "apt"  }}
// 4. Get suggestions for weak techniques{  "name": "suggest_detections",  "arguments": {    "technique_id": "T1078"  // Valid Accounts  }}

Building Detection Content

typescript
// 1. Search existing detections for pattern{  "name": "search",  "arguments": {    "query": "lateral movement SMB",    "limit": 10  }}
// 2. Analyze procedure coverage{  "name": "analyze_procedure_coverage",  "arguments": {    "technique_id": "T1021.002"  // SMB/Windows Admin Shares  }}
// 3. Get detection template{  "name": "generate_detection_template",  "arguments": {    "technique_id": "T1021.002",    "format": "sigma"  }}
// 4. Validate against existing detections{  "name": "list_by_mitre",  "arguments": {    "technique_id": "T1021.002"  }}

Cross-Platform Detection Comparison

typescript
// Compare Sigma vs Splunk for technique// 1. Get Sigma detections{  "name": "list_by_mitre",  "arguments": {    "technique_id": "T1003.001"  }}
// Filter results by source_type: "sigma"
// 2. Get Splunk detections{  "name": "list_by_source",  "arguments": {    "source_type": "splunk_escu"  }}
// Filter by same technique
// 3. Compare coverage{  "name": "analyze_coverage",  "arguments": {    "source_type": "sigma"  }}
{  "name": "analyze_coverage",  "arguments": {    "source_type": "splunk_escu"  }}

Configuration Reference

Environment Variables

VariableDescriptionExample
SIGMA_PATHSComma-separated Sigma rule directories/path/to/sigma/rules,/path/to/sigma/rules-threat-hunting
SPLUNK_PATHSSplunk ESCU detection directories/path/to/security_content/detections
STORY_PATHSSplunk analytic story directories (optional)/path/to/security_content/stories
ELASTIC_PATHSElastic detection rule directories/path/to/detection-rules/rules
KQL_PATHSKQL hunting query directories (comma-separated)/path/to/kql-bertjanp,/path/to/kql-jkerai1
SUBLIME_PATHSSublime Security rule directories/path/to/sublime-rules/detection-rules
CQL_HUB_PATHSCQL Hub (CrowdStrike) query directories/path/to/cql-hub/queries
ATTACK_STIX_PATHPath to enterprise-attack.json STIX bundle/path/to/enterprise-attack.json

Source Type Values

  • sigma - Sigma rules (YAML)
  • splunk_escu - Splunk Enterprise Security Content Update
  • elastic - Elastic Security detection rules
  • kql - Kusto Query Language hunting queries
  • sublime - Sublime Security detection rules
  • crowdstrike_cql - CrowdStrike Query Language (CQL)

Tactic Values (MITRE ATT&CK)

  • reconnaissance
  • resource-development
  • initial-access
  • execution
  • persistence
  • privilege-escalation
  • defense-evasion
  • credential-access
  • discovery
  • lateral-movement
  • collection
  • command-and-control
  • exfiltration
  • impact

Troubleshooting

MCP Server Not Indexing Rules

Problem: get_stats shows 0 detections

Solution:

  1. Verify paths exist: ls -la /path/to/sigma/rules
  2. Check environment variables are set correctly in MCP config
  3. Rebuild index manually:
    typescript
    {  "name": "rebuild_index",  "arguments": {}}
  4. Check MCP server logs in Claude Desktop: ~/Library/Logs/Claude/mcp*.log

Permission Denied Errors

Problem: Cannot read detection files

Solution:

bash
# Fix permissions on detection directorieschmod -R 755 ~/detections

Hosted MCP 401 Unauthorized

Problem: Token authentication failing

Solution:

  1. Verify token starts with sdmcp_
  2. Check token is not expired at detect.michaelhaag.org/account/tokens
  3. Ensure Authorization: Bearer header format is correct
  4. Free tier rate limit: 200 calls/day

Missing MITRE ATT&CK Data

Problem: Actor/technique queries return empty

Solution:

  1. Download STIX bundle:
    bash
    curl -o ~/detections/enterprise-attack.json \  https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json
  2. Set ATTACK_STIX_PATH environment variable
  3. Rebuild index

Sigma Rules Not Parsing

Problem: Some Sigma rules show errors

Solution:

  • Ensure you're using the official SigmaHQ repo
  • Update to latest rules: cd sigma && git pull
  • Some experimental rules may have schema issues - this is expected
  • Check parsing errors in MCP logs

Slow Initial Index Build

Problem: First startup takes 30+ seconds

Solution:

  • Expected behavior with 8,200+ detections
  • Subsequent startups use cached index (~2 seconds)
  • Use hosted MCP for zero startup time
  • Reduce PATHS to only needed sources

Advanced Usage

Custom Detection Repositories

Add your private detections:

json
{  "env": {    "SIGMA_PATHS": "/path/to/sigma/rules,/path/to/my-custom-sigma",    "SPLUNK_PATHS": "/path/to/security_content/detections,/path/to/internal-splunk"  }}

Autonomous Detection Pipeline

Enable autonomous CTI → detection generation:

typescript
// Configure autonomous settings (local only){  "name": "configure_autonomous",  "arguments": {    "enabled": true,    "cti_sources": ["misp", "otx"],    "auto_pr": false  // Manual review before PR  }}
// Trigger gap analysis{  "name": "run_autonomous_analysis",  "arguments": {    "threat_actor": "APT29"  }}

See Autonomous docs for full pipeline details.

Exporting for SIEM

typescript
// Export detections in native format{  "name": "export_detections",  "arguments": {    "technique_id": "T1055",    "format": "sigma",  // or splunk, elastic, kql    "output_path": "./exports/process_injection.yml"  }}

Expert Prompts

Built-in workflows accessible by name:

  • ransomware-readiness-assessment - Full kill-chain coverage analysis
  • apt-threat-emulation - Actor-specific detection mapping
  • purple-team-exercise - Combined offensive/defensive planning
  • executive-briefing - High-level coverage summary
  • detection-sprint-planning - Engineering backlog prioritization
  • insider-threat-detection - Privilege abuse coverage
  • cloud-security-assessment - Cloud-specific technique coverage
  • supply-chain-security - Third-party risk detection
  • data-exfiltration-defense - Exfiltration technique coverage
  • initial-access-hardening - Entry point detection review
  • credential-theft-protection - Credential access coverage

Usage:

Use the ransomware-readiness-assessment prompt

Resources

來源與署名

來源：reason-machines/security-skills位於skills/security-detections-mcp提交304c245

授權條款： 無授權條款

內容歸原作者所有。SourceWeft 從公開儲存庫中收錄這些內容。

檢舉或申請下架

更多來自 reason-machines/security-skills 的技能

Vibe Pentest Ai Security Testing

reason-machines

針對網頁應用程式、API 與管理後台的 AI 多代理自動化滲透測試，並產出安全報告。

Security112 個月前更新

Unisecurityguard Academic Whistleblower Archive

reason-machines

指導建立以 GitHub 為基礎的學術職場舉報與遭審查社群媒體證據典藏平台。

Security112 個月前更新

Security Threat Awareness

reason-machines

提醒使用者警覺偽裝成破解安全軟體的 GitHub 惡意軟體散布倉庫。

Security112 個月前更新

S800 Vehicle Network Security Testing

reason-machines

指導車用 CAN 匯流排與車載網路的安全測試，涵蓋流量擷取、模糊測試、ECU 掃描、重播與 UDS 診斷。

Security112 個月前更新

Pentest Agents Bug Bounty Framework

reason-machines

自主漏洞賞金框架，內含狩獵代理、驗證關卡、漏洞利用鏈與平台 MCP 伺服器。

Security112 個月前更新

Mcp Security Hub

reason-machines

部署並設定 38 個 Docker 化 MCP 伺服器，將攻擊性安全工具接入 AI 助理。

Security112 個月前更新

更多Security技能

Kyc Rules

anthropics

精選

將公司的 KYC/AML 規則表套用於已解析的開戶紀錄，評定風險並給出處理路由。

Security39K2 週前更新

Kyc Rules

anthropics

精選

將公司的 KYC/AML 規則表套用於已解析的開戶紀錄，評定風險並給出處理路由。

Security39K2 週前更新

Compliance Tracking

anthropics

精選

追蹤合規要求、稽核準備情況，以及 SOC 2、ISO 27001、GDPR、HIPAA 和 PCI DSS 等框架的證據。

Security27K今天更新

Dpop Adoption

google

精選

指導為 Google OAuth 平台實作 OAuth 2.0 DPoP（RFC 9449）傳送方約束的更新權杖。

Security21K今天更新

Secops Triage

google

精選

引導 SOC 分析師對 Google SecOps 安全警示進行分診，從調查到結案或升級。

Security21K今天更新

Secops Investigate

google

精選

指導 SOC 分析師在 Google SecOps 中使用 UDM 查詢與時間軸進行深入的安全事件與實體調查。

Security21K今天更新