SECURITY DETECTIONS MCP

Summary from the TLDR InfoSec newsletter

Security Detections MCP is an MCP server that enables LLMs to query a unified database of over 7,200 Sigma, Splunk ESCU, Elastic, and KQL security detection rules through natural language. The tool features SQLite FTS5-powered full-text search across detection fields, MITRE ATT&CK mapping, CVE coverage lookup, and process name filtering, with token-optimized analysis tools that reduce data transfer by 25x compared to traditional queries. Security teams can integrate this with Claude Desktop, Cursor IDE, or VS Code to perform coverage analysis, identify detection gaps against threat profiles, and generate ATT&CK Navigator layers directly from their AI assistant.