security-detections-mcp

Skill by ara.so — MCP Skills collection.

MCP server providing AI agents access to 8,200+ security detection rules across 6 formats (Sigma, Splunk ESCU, Elastic, KQL, Sublime, CrowdStrike CQL) with MITRE ATT&CK mapping, coverage analysis, threat actor emulation, and autonomous detection engineering workflows.

What It Does

• Unified Detection Search: Query across all detection formats with single API
• MITRE ATT&CK Integration: 172 threat actors, 784 software, 4,362 relationships from STIX
• Coverage Analysis: Identify gaps by tactic, technique, threat actor, or procedure
• Navigator Layers: Export ATT&CK Navigator JSON for coverage visualization
• Autonomous Pipeline: CTI ingestion → gap analysis → detection generation → Atomic testing
• 81 MCP Tools: Search, filter, analyze, generate, and compare detections
• 11 Expert Prompts: Ransomware assessment, APT emulation, purple team workflows

Installation

Local (Full Power)