Security Detections MCP

Unified Detection Engineering Platform
7,283+ detections across Sigma, Splunk ESCU, Elastic & KQL — powered by MCP

Quick Start • Workbench • 106 Tools • 22 Workflows • Agents • Config

Built on Security Detections MCP by MHaggis  •  Threat Intelligence by Threadlinqs

What is this?

Security Detections MCP is an open-source platform that unifies 7,283+ detection rules from four major sources into a single queryable interface using the Model Context Protocol (MCP). It combines:

• An MCP Server with 74 tools for searching, analyzing, and engineering detections
• A Threat Intelligence MCP Server (Threadlinqs Intel) with 32 tools for real-time threat feeds, C2 tracking, MITRE mapping, and DNS enrichment
• A Web Dashboard (Detection Workbench) for visual exploration, workflow execution, and AI-powered ad-hoc analysis
• An Autonomous Agent Pipeline (LangGraph) for end-to-end detection generation and validation

Detection Sources

Quick Start

Prerequisites

• Node.js >= 18.0.0
• npm >= 8.0.0
• Git (for cloning detection repos)

1. Clone and build the MCP server

git clone https://github.com/MHaggis/Security-Detections-MCP.git
cd Security-Detections-MCP
npm install
npm run build

2. Clone detection rule repositories

mkdir -p detections && cd detections

# Sigma rules
git clone https://github.com/SigmaHQ/sigma.git

# Splunk ESCU
git clone https://github.com/splunk/security_content.git

# Elastic detection rules
git clone https://github.com/elastic/detection-rules.git

# KQL rules
git clone https://github.com/bert-jan/kql.git kql-bertjanp
git clone https://github.com/jkerai1/SentinelAnalyticRules.git kql-jkerai1

cd ..

3. Start the workbench

cd workbench
npm install
npm run dev

Open http://localhost:3000 in your browser.

4. Configure API keys

Navigate to Settings in the workbench sidebar and configure:

• LLM Provider — Choose Anthropic (Claude) or OpenAI (GPT-4) and enter your API key
• Threadlinqs Intel API Key — Get yours at intel.threadlinqs.com for real-time threat intelligence

Without an LLM API key, ad-hoc queries and llm_prompt workflow steps won't function. Without a Threadlinqs key, threat intelligence workflows will skip intel steps but detection tools will work normally.

Architecture

┌─────────────────────────────────────────────────────────────────┐
│                    Detection Workbench (Next.js)                │
│  Dashboard │ Tools │ Workflows │ Ad-Hoc │ Threats │ Coverage    │
├──────────────────────┬──────────────────────────────────────────┤
│    MCP Bridge        │         LLM Client                      │
│  (StdioTransport)    │   (Anthropic / OpenAI)                  │
├──────────┬───────────┼──────────────────────────────────────────┤
│          │           │                                          │
│  ┌───────▼────────┐  │  ┌─────────────────────┐                │
│  │ security-      │  │  │ threadlinqs-intel    │                │
│  │ detections     │  │  │ MCP Server (v3.1.1)  │                │
│  │ MCP Server     │  │  │                      │                │
│  │                │  │  │ 32 tools:            │                │
│  │ 74 tools:      │  │  │ • Threat feeds       │                │
│  │ • Search       │  │  │ • C2 tracking        │                │
│  │ • MITRE map    │  │  │ • MITRE mapping      │                │
│  │ • Knowledge    │  │  │ • CVE/CWE lookup     │                │
│  │ • Engineering  │  │  │ • IOC search         │                │
│  │ • Autonomous   │  │  │ • Simulations        │                │
│  └───────┬────────┘  │  └──────────┬──────────┘                │
│          │           │             │                            │
│  ┌───────▼───────────▼─────────────▼──────────┐                │
│  │              SQLite Cache                   │                │
│  │         7,283+ indexed detections           │                │
│  └───────────────┬────────────────────────────┘                │
│                  │                                              │
│  ┌───────────────▼────────────────────────────┐                │
│  │         Detection Rule Repositories         │                │
│  │   Sigma │ Splunk ESCU │ Elastic │ KQL       │                │
│  └─────────────────────────────────────────────┘                │
└─────────────────────────────────────────────────────────────────┘

Detection Workbench

The workbench is a full-featured web dashboard built with Next.js 15, React 19, and Tailwind CSS v4. It features a terminal-inspired hacker aesthetic with JetBrains Mono font, colored status indicators, and // section headers.

Dashboard

The command center with real-time stats, quick-launch workflows, recent activity, and server status at a glance.

Tool Explorer

Browse, search, and execute all 106 tools across both MCP servers. Blue indicators for security-detections, purple for threadlinqs-intel.

Click any tool to inspect its schema, parameters, and test it directly from the browser.

Filter by server to see the 32 Threadlinqs Intel tools — threat feeds, C2 tracking, simulations, and more.

Workflow Library

22 pre-built detection engineering workflows spanning threat hunting, coverage analysis, CVE assessment, and intelligence operations.

Visual Workflow Builder

Drag-and-drop canvas for designing custom detection pipelines. Connect tool calls, transforms, LLM analysis steps, conditionals, loops, and parallel branches.

Workflow Execution

Execute workflows against live MCP servers with real-time step-by-step progress tracking. Each step shows its type (tool_call, transform, llm_prompt), target server, and execution status.

Results include LLM-generated analysis with executive summaries, threat inventories, MITRE coverage matrices, and prioritized recommendations.

Ad-Hoc Terminal

Natural language interface powered by your configured LLM. Ask questions about your detections, threats, and coverage — the system automatically selects and calls the right MCP tools, then synthesizes the results.

Example queries:

• "What ransomware detections do we have?"
• "Show coverage gaps for credential access"
• "Compare Sigma vs Splunk detection counts"
• "Pull the latest threats from Threadlinqs and contrast them against my detections"

All Pages

MCP Tools

security-detections (74 tools)

Core Detection Tools