Armory
Source
Browse
MCPs

wrg-11-wrg-sigma-rules

Sigma detection rule writing, validation, and conversion (Splunk/Elastic/Kibana/Wazuh) via 3 MCP tools (`draft_rule`, `validate_rule`, `convert_rule`) backed by a 61-rule production corpus across 11 MITRE ATT&CK tactic categories. Standalone server + Claude Code plugin distribution.

Score
32.2231 signal
Evidence
2 stars
Last commit
as last read from GitHub; most reads are from 2 Sep 2026 or later
Listed

Install

No one-command install. Set it up from its source.

Alternatives · MCPs

  1. mhaggis-security-detections478 stars · 75 forks96.708
  2. rsigma136 stars · 16 forks91.911
  3. aidongise-cell-prism-scanner27 stars · 4 forks78.079

What it is

Sigma detection rule writing, validation, and conversion (Splunk/Elastic/Kibana/Wazuh) via 3 MCP tools (draft_rule, validate_rule, convert_rule) backed by a 61-rule production corpus across 11 MITRE ATT&CK tactic categories. Standalone server + Claude Code plugin distribution.

When to use it

When an agent needs the "Security" capability this MCP server exposes.

Source

Migrated from the awesome-mcp-servers navigation directory (category: Security). See https://github.com/WRG-11/wrg-sigma-rules.