Security Detections

Security Detections MCP is an MCP server that provides AI agents with direct access to a unified database of security detection rules.

The MCP server indexes and normalizes detection content from four major sources: Sigma, Splunk ESCU, Elastic, and KQL. It stores everything in a local SQLite database with full-text search capabilities, and it exposes over 25 specialized query tools through the MCP.

Features

• 🔍 Unified Full-Text Search: SQLite FTS5-powered search across detection names, descriptions, queries, CVE identifiers, process names, MITRE mappings, and more
• 🗂️ Multi-Format Support: Parses YAML (Sigma, Splunk), TOML (Elastic), and Markdown/raw .kql (KQL hunting queries)
• 🎯 MITRE ATT&CK Integration: Filter detections by technique ID (e.g., T1059.001) or tactic (e.g., credential-access, persistence)
• 🛡️ CVE Coverage Lookup: Find all detections targeting a specific vulnerability identifier
• ⚙️ Process Name Filtering: Search for detections referencing specific executables like powershell.exe or w3wp.exe
• 📊 Token-Optimized Analysis Tools: Server-side processing returns minimal, actionable data instead of full detection objects
• 📈 Coverage Gap Analysis: Identify detection gaps against threat profiles (ransomware, APT, persistence)
• 🗺️ ATT&CK Navigator Export: Generate ready-to-import Navigator layer JSON files
• 📖 Analytic Story Search: Query Splunk’s threat campaign narratives for additional context
• 🔄 Auto-Indexing: Automatically indexes all configured paths on server startup

Use Cases

• Gap Analysis & Coverage Mapping: Security engineers can query the database to identify which specific MITRE ATT&CK techniques are missing from their current detection set (e.g., “Show me gaps in my Ransomware coverage for Elastic”).
• Rule Translation & Logic Validation: Detection engineers can retrieve a Splunk SPL rule and ask the LLM to convert the logic into a Sigma rule or KQL query while referencing the actual source logic.
• Incident Response & Threat Hunting: Analysts can quickly pull up all detections related to a specific artifact, such as w3wp.exe or CVE-2024-27198, to determine what to look for during an active investigation.
• Rapid Content Deployment: Developers can download the latest rules from upstream repositories and immediately query them through the MCP server to stay current with emerging threats without waiting for vendor updates.

How to Use It

Installation

npx (Recommended)

npx -y security-detections-mcp

Clone and Build

git clone https://github.com/MHaggis/Security-Detections-MCP.git
cd Security-Detections-MCP
npm install
npm run build

Download Detection Content

The MCP server requires local copies of detection rule repositories. The sparse checkout method downloads only the rules directories (not full git history), which saves significant disk space.

Create a detections directory and download all sources:

# Create detections directory
mkdir -p detections && cd detections
# Download Sigma rules (~3,000+ rules)
git clone --depth 1 --filter=blob:none --sparse https://github.com/SigmaHQ/sigma.git
cd sigma && git sparse-checkout set rules rules-threat-hunting && cd ..
# Download Splunk ESCU detections + stories (~2,000+ detections, ~330 stories)
git clone --depth 1 --filter=blob:none --sparse https://github.com/splunk/security_content.git
cd security_content && git sparse-checkout set detections stories && cd ..
# Download Elastic detection rules (~1,500+ rules)
git clone --depth 1 --filter=blob:none --sparse https://github.com/elastic/detection-rules.git
cd detection-rules && git sparse-checkout set rules && cd ..
# Download KQL hunting queries (~400+ queries from 2 repos)
git clone --depth 1 https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules.git kql-bertjanp
git clone --depth 1 https://github.com/jkerai1/KQL-Queries.git kql-jkerai1

The script outputs the exact paths to use in your MCP configuration.

Alternative: Full Clone

Clone complete repositories if you need git history:

git clone https://github.com/SigmaHQ/sigma.git
git clone https://github.com/splunk/security_content.git
git clone https://github.com/elastic/detection-rules.git
git clone https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules.git
git clone https://github.com/jkerai1/KQL-Queries.git

Configuration

Environment Variables

Cursor IDE Configuration

Add to ~/.cursor/mcp.json or .cursor/mcp.json in your project:

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": ["-y", "security-detections-mcp"],
      "env": {
        "SIGMA_PATHS": "/path/to/sigma/rules,/path/to/sigma/rules-threat-hunting",
        "SPLUNK_PATHS": "/path/to/security_content/detections",
        "ELASTIC_PATHS": "/path/to/detection-rules/rules",
        "KQL_PATHS": "/path/to/Hunting-Queries-Detection-Rules",
        "STORY_PATHS": "/path/to/security_content/stories"
      }
    }
  }
}

Claude Desktop Configuration

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": ["-y", "security-detections-mcp"],
      "env": {
        "SIGMA_PATHS": "/Users/you/sigma/rules,/Users/you/sigma/rules-threat-hunting",
        "SPLUNK_PATHS": "/Users/you/security_content/detections",
        "ELASTIC_PATHS": "/Users/you/detection-rules/rules",
        "KQL_PATHS": "/Users/you/Hunting-Queries-Detection-Rules",
        "STORY_PATHS": "/Users/you/security_content/stories"
      }
    }
  }
}

Database Location

The SQLite index is stored at ~/.cache/security-detections-mcp/detections.sqlite. The server creates this file automatically on first run and re-indexes when paths change. Use the rebuild_index() tool to manually refresh the index after updating your detection repositories.

All Available MCP Tools

FAQs

Q: Why are my search results empty after installation?
A: The server requires local content to function. Verify that you cloned the repositories into the paths specified in your env configuration. If the paths are correct, run the rebuild_index() tool once to force the SQLite database to populate.

Q: Can I use this with my private detection repository?
A: Yes. If your private repository follows the standard Sigma, Splunk, or Elastic file structure, you can simply add the path to the corresponding environment variable (e.g., add your path to SIGMA_PATHS).

Q: Does this send my queries or rules to a third-party cloud?
A: No. The indexing and searching happen entirely locally using SQLite. The only external communication occurs between your MCP client (Claude/Cursor) and the LLM provider you are already using.

Q: How do I update the rules?
A: You must update the local git repositories manually. Navigate to your detections folders and run git pull. Afterward, ask the MCP to run rebuild_index() to update the internal database.

Q: What happens if I don’t define all path variables?
A: You must define at least one path variable (SIGMA_PATHS, SPLUNK_PATHS, ELASTIC_PATHS, or KQL_PATHS) for the server to start. You can omit the ones you do not wish to use.