Security Detections is a Model Context Protocol (MCP) server designed to empower security defenders and detection engineers. It unifies disparate security detection rules – including Sigma, Splunk ESCU, Elastic, and KQL – into a single, queryable database. This allows Large Language Models (LLMs) to interact with and analyze a vast repository of detection logic, helping security professionals build detections more efficiently and intelligently by providing a comprehensive, searchable view of their detection coverage.
