Security Detections

关于

Security Detections is a Model Context Protocol (MCP) server designed to empower security defenders and detection engineers. It unifies disparate security detection rules – including Sigma, Splunk ESCU, Elastic, and KQL – into a single, queryable database. This allows Large Language Models (LLMs) to interact with and analyze a vast repository of detection logic, helping security professionals build detections more efficiently and intelligently by providing a comprehensive, searchable view of their detection coverage.

主要功能

• Unified Search across Sigma, Splunk ESCU, Elastic, and KQL detections
• Auto-Indexing of detection rules from configured local paths
• Full-Text Search on names, descriptions, queries, MITRE tactics, CVEs, and process names
• 42 GitHub stars
• MITRE ATT&CK Mapping for filtering by technique ID or tactic
• CVE and Process Name Coverage to find relevant detections

使用案例

• Compare detection coverage across different security platforms like Sigma, Splunk, Elastic, and KQL.
• Efficiently find PowerShell detections related to specific encoding techniques.
• Verify existing detection coverage for new CVE vulnerabilities.