Enables Large Language Models to query a unified database of security detection rules from various formats.
Sponsored
Security Detections is a Model Context Protocol (MCP) server designed to empower security defenders and detection engineers. It unifies disparate security detection rules – including Sigma, Splunk ESCU, Elastic, and KQL – into a single, queryable database. This allows Large Language Models (LLMs) to interact with and analyze a vast repository of detection logic, helping security professionals build detections more efficiently and intelligently by providing a comprehensive, searchable view of their detection coverage.
Key Features
01Unified Search across Sigma, Splunk ESCU, Elastic, and KQL detections
02Auto-Indexing of detection rules from configured local paths
03Full-Text Search on names, descriptions, queries, MITRE tactics, CVEs, and process names
0442 GitHub stars
05MITRE ATT&CK Mapping for filtering by technique ID or tactic
06CVE and Process Name Coverage to find relevant detections
Use Cases
01Compare detection coverage across different security platforms like Sigma, Splunk, Elastic, and KQL.
02Efficiently find PowerShell detections related to specific encoding techniques.
03Verify existing detection coverage for new CVE vulnerabilities.
