Security Detections Mcp

This is essentially a unified API for security detection rules across six major platforms, giving you programmatic access to 8,200+ detections from Sigma, Splunk, Elastic, KQL, Sublime, and CrowdStrike. The real utility is in the MITRE ATT&CK integration: you can query coverage by technique, identify gaps for specific threat actors like APT29, and generate ATT&CK Navigator layers showing where your detections actually exist. It comes with 81 tools for local use or around 25 if you use the hosted version, which offers a free tier with 200 calls per day. Most useful when you're doing threat modeling, need to answer "do we detect this technique" questions quickly, or building detection coverage reports without manually parsing YAML files across multiple repositories.

skills.sh installs: 754
GitHub stars: 6
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add aradotso/security-skills --skill security-detections-mcp --agent claude-code

Installs into .claude/skills of the current project.

Files

security-detections-mcp

Skill by ara.so — Security Skills collection

An MCP (Model Context Protocol) server providing LLM access to 8,200+ security detection rules across Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL formats, with MITRE ATT&CK mapping, coverage analysis, and autonomous detection engineering.

What It Does

Unified detection search across 6 major security platforms (Sigma, Splunk, Elastic, KQL, Sublime, CrowdStrike)
MITRE ATT&CK integration with 172 threat actors, 784 software, 4,362 actor-technique relationships
Coverage analysis identifying gaps in detection by tactic/technique/actor
ATT&CK Navigator layers exportable as JSON for visualization
Autonomous detection pipeline from CTI ingestion to draft PR generation
81 MCP tools for detection engineering (local) or ~25 tools (hosted)
11 expert prompts for ransomware assessment, APT emulation, purple teaming