Armory
Source
Browse
MCPs

security-detections-mcp

Unifies 7,283+ detection rules from Sigma, Splunk ESCU, Elastic, and KQL into a single queryable interface via MCP, with a web dashboard and autonomous agent pipeline for detection engineering.

Score
41.0822 signals
Evidence
1 star · 2 forks
Last commit
as last read from GitHub; most reads are from 2 Sep 2026 or later
Listed

Install

No one-command install. Set it up from its source.

Alternatives · MCPs

  1. mhaggis-security-detections478 stars · 75 forks96.708
  2. rsigma136 stars · 16 forks91.911
  3. nullplatform-meta-mcp-proxy11 stars · 4 forks69.349

What it is

Unifies 7,283+ detection rules from Sigma, Splunk ESCU, Elastic, and KQL into a single queryable interface via MCP, with a web dashboard and autonomous agent pipeline for detection engineering.

When to use it

Unifies 7,283+ detection rules from Sigma, Splunk ESCU, Elastic, and KQL into a single queryable interface via MCP, with a web dashboard and autonomous agent pipeline for detection engineering.

How to install / invoke

See Glama for the install config.

Notes

Listed from the Glama MCP registry.