NestDaddy
All servers NestDaddy MCP Blog Sign inTry it free
Security

Security Detections

io.github.MHaggis/security-detections-mcp ยท v3.3.4

Search security detections across Sigma, Splunk, Elastic, KQL, Sublime, CQL and Jamf with ATT&CK.

Source code Set it up

Connect Runs on your machine

Terminal
claude mcp add security-detections-mcp -e SIGMA_PATHS=<SIGMA_PATHS> -e SPLUNK_PATHS=<SPLUNK_PATHS> -e ELASTIC_PATHS=<ELASTIC_PATHS> -e KQL_PATHS=<KQL_PATHS> -e SUBLIME_PATHS=<SUBLIME_PATHS> -e CQL_HUB_PATHS=<CQL_HUB_PATHS> -e JAMF_PROTECT_PATHS=<JAMF_PROTECT_PATHS> -e STORY_PATHS=<STORY_PATHS> -- npx -y [email protected]
claude_desktop_config.json
{
  "mcpServers": {
    "security-detections-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "SIGMA_PATHS": "<SIGMA_PATHS>",
        "SPLUNK_PATHS": "<SPLUNK_PATHS>",
        "ELASTIC_PATHS": "<ELASTIC_PATHS>",
        "KQL_PATHS": "<KQL_PATHS>",
        "SUBLIME_PATHS": "<SUBLIME_PATHS>",
        "CQL_HUB_PATHS": "<CQL_HUB_PATHS>",
        "JAMF_PROTECT_PATHS": "<JAMF_PROTECT_PATHS>",
        "STORY_PATHS": "<STORY_PATHS>"
      }
    }
  }
}
~/.cursor/mcp.json
{
  "mcpServers": {
    "security-detections-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "SIGMA_PATHS": "<SIGMA_PATHS>",
        "SPLUNK_PATHS": "<SPLUNK_PATHS>",
        "ELASTIC_PATHS": "<ELASTIC_PATHS>",
        "KQL_PATHS": "<KQL_PATHS>",
        "SUBLIME_PATHS": "<SUBLIME_PATHS>",
        "CQL_HUB_PATHS": "<CQL_HUB_PATHS>",
        "JAMF_PROTECT_PATHS": "<JAMF_PROTECT_PATHS>",
        "STORY_PATHS": "<STORY_PATHS>"
      }
    }
  }
}
.vscode/mcp.json
{
  "servers": {
    "security-detections-mcp": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "SIGMA_PATHS": "<SIGMA_PATHS>",
        "SPLUNK_PATHS": "<SPLUNK_PATHS>",
        "ELASTIC_PATHS": "<ELASTIC_PATHS>",
        "KQL_PATHS": "<KQL_PATHS>",
        "SUBLIME_PATHS": "<SUBLIME_PATHS>",
        "CQL_HUB_PATHS": "<CQL_HUB_PATHS>",
        "JAMF_PROTECT_PATHS": "<JAMF_PROTECT_PATHS>",
        "STORY_PATHS": "<STORY_PATHS>"
      }
    }
  }
}

Replace the values in angle brackets with your own. Keys stay on your machine; we never see them.

Tools

This server runs locally, so its tools are listed by your MCP client once it starts.

Environment variables

NameDescription
SIGMA_PATHS
Optional		Comma-separated paths to Sigma rule directories (e.g., /path/to/sigma/rules,/path/to/sigma/rules-threat-hunting)
SPLUNK_PATHS
Optional		Comma-separated paths to Splunk ESCU detection directories (e.g., /path/to/security_content/detections)
ELASTIC_PATHS
Optional		Comma-separated paths to Elastic detection rule directories (e.g., /path/to/detection-rules/rules)
KQL_PATHS
Optional		Comma-separated paths to KQL hunting query directories (e.g., /path/to/kql-queries)
SUBLIME_PATHS
Optional		Comma-separated paths to Sublime MQL rule directories (e.g., /path/to/sublime-rules/detection-rules,/path/to/delivr-detections/sublime-rules)
CQL_HUB_PATHS
Optional		Comma-separated paths to CQL Hub (CrowdStrike) query directories (e.g., /path/to/cql-hub/queries)
JAMF_PROTECT_PATHS
Optional		Comma-separated paths to Jamf Protect custom analytic detection directories (macOS, e.g., /path/to/jamfprotect/custom_analytic_detections)
STORY_PATHS
Optional		Comma-separated paths to Splunk analytic story directories (optional, e.g., /path/to/security_content/stories)

Details

Package[email protected] (NPM, stdio)
First published4 Nov 2026
Last updated4 Nov 2026
Registry nameio.github.MHaggis/security-detections-mcp

More security servers See all

Listing data from the official MCP registry. Status and tools from NestDaddy's daily check. Browse all MCP servers.