Enrichment
Enriches data from multiple security products using a Model Context Protocol server.
This tool provides an MCP server implementation for enriching observable data using various third-party security services like VirusTotal, Hybrid Analysis, and AlienVault. It leverages the security-cli Python package to perform enrichment and communicate with these services, enabling easy integration with the Model Context Protocol and providing valuable context for security investigations.
Key Features
01Supports multiple observable types (IP, Domain, URL, Email)
02Uses security-cli for service communication and configuration
03Integrates with various security services (VirusTotal, HybridAnalysis, AlienVault, etc.)
04Configurable via YAML and environment variables
05Provides customizable prompt templates for different services
060 GitHub stars
Use Cases
01Investigating suspicious IPs, domains, and URLs
02Enriching security alerts with threat intelligence data
03Providing contextual information for security incidents