Security Detections
Aggregates security detection rules from Sigma, Splunk ESCU, Elastic, and KQL into a unified searchable SQLite database with MITRE
An MCP server that provides unified access to security detection rules from Sigma, Splunk ESCU, Elastic Detection Rules, and KQL query repositories. The implementation indexes detection rules into a searchable SQLite database with full-text search capabilities, automatically parsing YAML and TOML formats to extract MITRE ATT&CK mappings, CVE references, process names, and other metadata. Supports advanced filtering by MITRE tactics, severity levels, data sources, and process names, making it useful for security analysts building detection coverage maps, threat hunters researching specific attack techniques, or security engineers comparing detection approaches across different SIEM platforms.
Source
Repository: https://github.com/mhaggis/security-detections-mcp
Maintain Security Detections?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/mcp/mhaggis-security-detections-mcp?ref=badge) Related mcp
DroidMind Enables control and interaction with Android devices through secure tools for device management, app installation, UI automation,
Skillz Executes local Anthropic-style skills through directory-based discovery where each skill contains YAML metadata and Markdown instr
Frida Enables dynamic instrumentation of mobile and desktop applications through Frida toolkit, providing capabilities for process manag
VS Code Exposes VS Code's filesystem, editing capabilities, symbol search, diagnostics, and terminal access as tools for AI-assisted codin
Centralmind (Database Gateway) Database integration with security and compliance. Supports: PostgreSQL, MySQL, ClickHouse, Snowflake, MSSQL, BigQuery, Oracle Dat
VNC Remote Control for macOS Provides secure remote control of macOS machines through VNC protocol, enabling screenshot capture and desktop interaction with mo