# security-detections-mcp

Connects your coding agent to an MCP server querying detection rules across Sigma, Splunk, and Elastic. Useful for spotting coverage gaps in MITRE ATT&CK.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 858 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/security-detections-mcp/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/security-detections-mcp

## What it does

The skill connects your coding assistant to a collection of 8,200+ detection rules. It searches queries across Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL syntax. The database incorporates MITRE ATT&CK threat intelligence. That includes 172 threat actors, 784 software entries, and 4,362 actor-technique relationships.

The system pinpoints detection gaps across tactics or individual adversaries. It generates exportable JSON layers for ATT&CK Navigator and drafts pull requests from incoming threat intelligence reports. Running it locally exposes 81 MCP tools alongside 11 expert prompts for ransomware assessments or purple team exercises. The hosted alternative provides around 25 tools.

Full local operation demands Node.js 18+ and cloned rule repositories on disk. Directories must exist locally. Without configured environment paths pointing to those files, the server will fail to load rules. The hosted cloud endpoint avoids local downloads, yet its free token caps usage at 200 daily calls under read-only access.

## Requirements
- Works with: Splunk

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-detections-mcp -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/security-detections-mcp/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/security-detections-mcp/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-detections-mcp -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/security-detections-mcp/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-detections-mcp -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/security-detections-mcp/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills security-detections-mcp
```

2. **Manually: put the files in place**
- File: `.github/skills/security-detections-mcp/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-detections-mcp -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/security-detections-mcp
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/security-detections-mcp/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill security-detections-mcp -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/security-detections-mcp/SKILL.md

## When to use it
- Search detection rules for a specific MITRE ATT&CK technique
- Audit detection coverage gaps against ransomware tactics
- Export custom JSON layers for ATT&CK Navigator
- Retrieve Splunk or Sigma rules targeting credential dumping

## Example prompts
- Search for Sigma rules that detect process injection techniques
- Analyze our MITRE ATT&CK coverage against ransomware threats
- Show me Splunk rules designed for credential dumping

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md