Security Detections
Search security detections across Sigma, Splunk, Elastic, KQL, Sublime, CQL and Jamf with ATT&CK.
io.github.MHaggis/security-detections-mcp · Repository · version 3.3.4 · 525 stars · listed from registry
Install
The sweep installs into a clean prefix, but this is the command a user would run:
npx security-detections-mcpResults by platform
Linux
installs and connects2026-11-09 · probed over npm1 recorded run, oldest first.
tools/list returned 81 tools.
search get_by_id get_raw_yaml list_all list_by_source list_by_mitre list_by_logsource list_by_severity list_by_cve list_by_analytic_story list_by_process_name list_by_detection_type list_by_data_source list_by_mitre_tactic list_by_kql_category list_by_kql_tag list_by_kql_datasource get_stats get_technique_ids analyze_coverage identify_gaps suggest_detections generate_navigator_layer analyze_procedure_coverage compare_procedure_coverage get_detection_list compare_sources count_by_source list_by_name_pattern smart_compare get_coverage_summary get_top_gaps get_technique_count analyze_actor_coverage list_actors compare_actor_coverage get_actor_profile search_stories get_story list_stories list_stories_by_category save_query get_saved_query list_saved_queries rebuild_index save_template run_template list_templates get_template delete_template
macOS
installs and connects2026-11-09 · probed over npm1 recorded run, oldest first.
tools/list returned 81 tools.
search get_by_id get_raw_yaml list_all list_by_source list_by_mitre list_by_logsource list_by_severity list_by_cve list_by_analytic_story list_by_process_name list_by_detection_type list_by_data_source list_by_mitre_tactic list_by_kql_category list_by_kql_tag list_by_kql_datasource get_stats get_technique_ids analyze_coverage identify_gaps suggest_detections generate_navigator_layer analyze_procedure_coverage compare_procedure_coverage get_detection_list compare_sources count_by_source list_by_name_pattern smart_compare get_coverage_summary get_top_gaps get_technique_count analyze_actor_coverage list_actors compare_actor_coverage get_actor_profile search_stories get_story list_stories list_stories_by_category save_query get_saved_query list_saved_queries rebuild_index save_template run_template list_templates get_template delete_template
Windows
installs and connects2026-11-09 · probed over npm1 recorded run, oldest first.
tools/list returned 81 tools.
search get_by_id get_raw_yaml list_all list_by_source list_by_mitre list_by_logsource list_by_severity list_by_cve list_by_analytic_story list_by_process_name list_by_detection_type list_by_data_source list_by_mitre_tactic list_by_kql_category list_by_kql_tag list_by_kql_datasource get_stats get_technique_ids analyze_coverage identify_gaps suggest_detections generate_navigator_layer analyze_procedure_coverage compare_procedure_coverage get_detection_list compare_sources count_by_source list_by_name_pattern smart_compare get_coverage_summary get_top_gaps get_technique_count analyze_actor_coverage list_actors compare_actor_coverage get_actor_profile search_stories get_story list_stories list_stories_by_category save_query get_saved_query list_saved_queries rebuild_index save_template run_template list_templates get_template delete_template
Install took 2m 27s on this platform.
Badge
Paste this into the project README to show the current result:
[](https://doesitinstall.com/s/io.github.mhaggis__security-detections-mcp.html)