npx -y security-detections-mcp

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": ["-y", "security-detections-mcp"],
      "env": {
        "SIGMA_PATHS": "/path/to/sigma/rules,/path/to/sigma/rules-threat-hunting",
        "SPLUNK_PATHS": "/path/to/security_content/detections",
        "STORY_PATHS": "/path/to/security_content/stories",
        "ELASTIC_PATHS": "/path/to/detection-rules/rules",
        "KQL_PATHS": "/path/to/kql-rules",
        "SUBLIME_PATHS": "/path/to/sublime-rules/detection-rules",
        "CQL_HUB_PATHS": "/path/to/cql-hub/queries",
        "ATTACK_STIX_PATH": "/path/to/enterprise-attack.json"
      }
    }
  }
}

{
  "mcp": {
    "servers": {
      "security-detections": {
        "command": "npx",
        "args": ["-y", "security-detections-mcp"],
        "env": {
          "SIGMA_PATHS": "/Users/you/detections/sigma/rules",
          "SPLUNK_PATHS": "/Users/you/detections/security_content/detections"
        }
      }
    }
  }
}

{
  "mcp.servers": {
    "security-detections": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "security-detections-mcp"],
      "env": {
        "SIGMA_PATHS": "/home/you/detections/sigma/rules"
      }
    }
  }
}

{
  "mcpServers": {
    "security-detections": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://detect.michaelhaag.org/api/mcp/mcp",
        "--header",
        "Authorization: Bearer ${SDMCP_TOKEN}"
      ]
    }
  }
}

{
  "mcp.servers": {
    "security-detections": {
      "type": "http",
      "url": "https://detect.michaelhaag.org/api/mcp/mcp",
      "headers": {
        "Authorization": "Bearer ${SDMCP_TOKEN}"
      }
    }
  }
}

mkdir -p ~/detections && cd ~/detections

Then update environment variables to point to these paths.

// Full-text search across all detections
{
  "name": "search",
  "arguments": {
    "query": "process injection",
    "limit": 10
  }
}

// Get specific detection by ID
{
  "name": "get_by_id",
  "arguments": {
    "id": "sigma_abc123"
  }
}

// List all detections with pagination
{
  "name": "list_all",
  "arguments": {
    "limit": 50,
    "offset": 0
  }
}

// Filter by source type
{
  "name": "list_by_source",
  "arguments": {
    "source_type": "sigma"  // sigma, splunk_escu, elastic, kql, sublime, crowdstrike_cql
  }
}

// Get index statistics
{
  "name": "get_stats",
  "arguments": {}
}

// Find detections for specific technique
{
  "name": "list_by_mitre",
  "arguments": {
    "technique_id": "T1059.001"  // PowerShell
  }
}

// Filter by tactic
{
  "name": "list_by_mitre_tactic",
  "arguments": {
    "tactic": "execution"  // execution, persistence, privilege-escalation, etc.
  }
}

// Search by CVE
{
  "name": "list_by_cve",
  "arguments": {
    "cve_id": "CVE-2021-34527"  // PrintNightmare
  }
}

// Find by process name
{
  "name": "list_by_process_name",
  "arguments": {
    "process_name": "powershell.exe"
  }
}

// Filter by severity
{
  "name": "list_by_severity",
  "arguments": {
    "level": "critical"  // critical, high, medium, low
  }
}

// Filter by data source
{
  "name": "list_by_data_source",
  "arguments": {
    "data_source": "process_creation"
  }
}

// Analyze overall coverage (~2KB response)
{
  "name": "analyze_coverage",
  "arguments": {
    "source_type": "sigma"  // optional: analyze specific source
  }
}

// Identify gaps for threat profile (~500B response)
{
  "name": "identify_gaps",
  "arguments": {
    "threat_profile": "ransomware"  // ransomware, apt, persistence, lateral_movement
  }
}

// Get detection suggestions for technique (~2KB)
{
  "name": "suggest_detections",
  "arguments": {
    "technique_id": "T1003.001"  // LSASS Memory
  }
}

// Coverage summary by tactic (~200B)
{
  "name": "get_coverage_summary",
  "arguments": {
    "source_type": "splunk_escu"
  }
}

// Analyze coverage against threat actor
{
  "name": "analyze_actor_coverage",
  "arguments": {
    "actor": "APT29"
  }
}

// Compare coverage across multiple actors
{
  "name": "compare_actor_coverage",
  "arguments": {
    "actors": ["APT29", "APT28", "Lazarus Group"]
  }
}

// Behavioral procedure breakdown for technique
{
  "name": "analyze_procedure_coverage",
  "arguments": {
    "technique_id": "T1055"
  }
}

// Generate Navigator layer JSON
{
  "name": "generate_navigator_layer",
  "arguments": {
    "name": "Current Coverage",
    "description": "Detection coverage as of 2024-01",
    "filter": {
      "source": "sigma",
      "tactic": "defense-evasion",
      "min_severity": "medium"
    },
    "color_by": "coverage"  // coverage, severity, source
  }
}

// Export to file (local only)
{
  "name": "export_navigator_layer",
  "arguments": {
    "output_path": "./coverage-layer.json",
    "filter": {
      "actor": "APT29"
    }
  }
}

Use the ransomware-readiness-assessment prompt to evaluate our coverage

// 1. Identify gaps
{
  "name": "identify_gaps",
  "arguments": {
    "threat_profile": "ransomware"
  }
}

// 2. Get detections for weak areas
{
  "name": "list_by_mitre",
  "arguments": {
    "technique_id": "T1486"  // Data Encrypted for Impact
  }
}

// 3. Generate coverage layer
{
  "name": "generate_navigator_layer",
  "arguments": {
    "name": "Ransomware Coverage",
    "filter": {
      "threat_profile": "ransomware"
    }
  }
}

// 1. Analyze actor coverage
{
  "name": "analyze_actor_coverage",
  "arguments": {
    "actor": "APT29"
  }
}

// 2. Get techniques used by actor
{
  "name": "get_actor_techniques",
  "arguments": {
    "actor": "APT29"
  }
}

// 3. Find detections for each technique
{
  "name": "list_by_mitre",
  "arguments": {
    "technique_id": "T1059.001"
  }
}

// 4. Compare with other actors
{
  "name": "compare_actor_coverage",
  "arguments": {
    "actors": ["APT29", "APT28"]
  }
}

// 1. Get coverage summary
{
  "name": "get_coverage_summary",
  "arguments": {}
}

// 2. Analyze coverage by tactic
{
  "name": "analyze_coverage",
  "arguments": {}
}

// 3. Identify specific gaps
{
  "name": "identify_gaps",
  "arguments": {
    "threat_profile": "apt"
  }
}

// 4. Get suggestions for weak techniques
{
  "name": "suggest_detections",
  "arguments": {
    "technique_id": "T1078"  // Valid Accounts
  }
}

// 1. Search existing detections for pattern
{
  "name": "search",
  "arguments": {
    "query": "lateral movement SMB",
    "limit": 10
  }
}

// 2. Analyze procedure coverage
{
  "name": "analyze_procedure_coverage",
  "arguments": {
    "technique_id": "T1021.002"  // SMB/Windows Admin Shares
  }
}

// 3. Get detection template
{
  "name": "generate_detection_template",
  "arguments": {
    "technique_id": "T1021.002",
    "format": "sigma"
  }
}

// 4. Validate against existing detections
{
  "name": "list_by_mitre",
  "arguments": {
    "technique_id": "T1021.002"
  }
}

// Compare Sigma vs Splunk for technique
// 1. Get Sigma detections
{
  "name": "list_by_mitre",
  "arguments": {
    "technique_id": "T1003.001"
  }
}

// Filter results by source_type: "sigma"

// 2. Get Splunk detections
{
  "name": "list_by_source",
  "arguments": {
    "source_type": "splunk_escu"
  }
}

// Filter by same technique

// 3. Compare coverage
{
  "name": "analyze_coverage",
  "arguments": {
    "source_type": "sigma"
  }
}

{
  "name": "analyze_coverage",
  "arguments": {
    "source_type": "splunk_escu"
  }
}

undefined

undefined

{
  "env": {
    "SIGMA_PATHS": "/path/to/sigma/rules,/path/to/my-custom-sigma",
    "SPLUNK_PATHS": "/path/to/security_content/detections,/path/to/internal-splunk"
  }
}

// Configure autonomous settings (local only)
{
  "name": "configure_autonomous",
  "arguments": {
    "enabled": true,
    "cti_sources": ["misp", "otx"],
    "auto_pr": false  // Manual review before PR
  }
}

// Trigger gap analysis
{
  "name": "run_autonomous_analysis",
  "arguments": {
    "threat_actor": "APT29"
  }
}

// Export detections in native format
{
  "name": "export_detections",
  "arguments": {
    "technique_id": "T1055",
    "format": "sigma",  // or splunk, elastic, kql
    "output_path": "./exports/process_injection.yml"
  }
}

Use the ransomware-readiness-assessment prompt