# Cortex XSIAM MCP for AI Agents AI Agent Connect

> Cortex XSIAM MCP connects your AI agent directly to your security operations platform. It allows your agent to pull alerts, query logs via XQL, and trigger automated response playbooks. It's built for SOC teams who need to move from detection to remediation without constantly switching tabs.

## Overview
- **Category:** other
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/ai-agent-connect

## Description

Managing security incidents usually feels like a game of whack-a-mole across dozens of open tabs. You're jumping between your SIEM, your endpoint manager, and your threat intel feeds just to figure out if a single alert is a false positive or a full-blown breach. This Connector changes that by letting your AI agent do the heavy lifting for you. Instead of manually hunting through logs or clicking through every single endpoint to see what's running, you can just ask your agent to find the needle in the haystack. It can pull in the latest security alerts, grab specific incident details, and even run complex queries against your data to see where a threat is moving. If you need to take action, it can trigger your existing automated playbooks or isolate a machine from the network immediately. It's about having a teammate who knows your entire security stack and can act on your behalf in seconds. By adding this to your setup via Vinkius, you turn your AI into a functional part of your SOC. You get to stop doing the data entry and start making the high-level calls. You can move from detection to remediation without the friction of context switching. It turns a reactive process into a proactive one where the AI handles the tedious gathering of facts while you focus on the strategy.

## Tools

### execute_playbook
Run automated incident response playbooks to handle common security tasks quickly.

### get_alerts
List the security alerts currently detected by your Cortex XSIAM environment.

### scan_endpoint
Trigger a quick or deep malware scan on a specific managed device.

### get_endpoints
View all managed hosts and devices currently tracked in your system.

### get_incident_details
Fetch comprehensive information about a specific security incident using its ID.

### get_incidents
List all active security incidents and monitor your SOC queue.

### get_indicators
Retrieve indicators of compromise to check for known malicious artifacts.

### isolate_endpoint
Remove a specific compromised host from the network to stop lateral movement.

### run_xql_query
Execute XQL queries to perform advanced threat hunting and data analysis.

## Prompt Examples

**Prompt:** 
```
Check the last 5 security alerts and tell me if any involve a known malicious IP.
```

**Response:** 
```
I've pulled the latest alerts from your environment. Here are the top 5:

| Alert ID | Severity | Description | Timestamp |
| :--- | :--- | :--- | :--- |
| 8821 | High | Known Malicious IP Communication | 10:45 AM |
| 8822 | Med | Suspicious Login Attempt | 10:48 AM |
| 8823 | Low | Port Scan Detected | 10:50 AM |
| 8824 | Med | Unusual Data Outbound | 10:52 AM |
| 8825 | Low | Failed Login | 10:55 AM |

One alert (ID: 8821) involves a known malicious IP associated with a recent phishing campaign. I recommend checking the incident details for this one.
```

**Prompt:** 
```
Is there any evidence of lateral movement for incident 4492?
```

**Response:** 
```
I've analyzed the details for incident 4492. Based on the logs, the host was contacted by three other internal devices within 2 minutes of the initial infection. I can run a query to see which other hosts were involved if you'd like.
```

**Prompt:** 
```
We found a compromised laptop. Can you isolate it from the network now?
```

**Response:** 
```
I've identified the host you're referring to. I'm ready to isolate it from the network to prevent any further spread. Would you like me to proceed with the isolation now?
```

## Capabilities

### Pull security alerts
See what's firing right now in your environment.

### Run complex queries
Search logs and network data using XQL.

### Trigger automated responses
Run existing playbooks to handle incidents.

### Isolate compromised machines
Cut off a host from the network instantly.

### Audit device coverage
See every managed host in your fleet.

### Deep dive into incidents
Get the full context for a specific security event.

### Scan for malware
Trigger a quick or deep scan on a specific host.

## Use Cases

### Suspicious login triage
An alert fires for a suspicious login. Ask the agent to pull the incident details and check if other machines are affected to determine the scope.

### Ransomware containment
A host is confirmed to have ransomware. Tell the agent to isolate it from the network immediately to prevent the infection from spreading.

### IP hunting
You need to find a specific IP in the logs. Ask the agent to run a query to see every instance of that IP across the network.

### Post-cleanup verification
After a malware infection is cleaned, ask the agent to trigger a deep scan on the host to ensure no traces remain.

## Benefits

- Faster incident response: Trigger existing playbooks to handle common security tasks automatically instead of doing them manually.
- Instant network containment: Cut off a compromised host from the network the moment your agent confirms a threat.
- Deep threat hunting: Search logs and network data for hidden patterns without having to write complex queries every time.
- Simplified triage: Pull alerts and incident details into one place to get all the context you need in seconds.
- Better visibility: Keep a constant eye on your fleet and known threats by auditing endpoints and indicators.

## How It Works

The bottom line is you get a direct line from your AI agent to your security operations data and actions.

1. Connect your Cortex XSIAM credentials to the Connector via the Vinkius dashboard.
2. Authorize your AI client to access the specific tools you need.
3. Start asking your agent to hunt for threats or trigger response actions.

## Frequently Asked Questions

**How does the Cortex XSIAM MCP help my security team?**
It lets your AI agent interact directly with your security data. You can pull alerts, hunt for threats, and trigger actions like isolating hosts without switching tabs.

**Can I use this Connector to automate my incident response?**
Yes. You can have your agent trigger existing playbooks to handle routine tasks like resetting passwords or blocking IPs automatically.

**Will this Connector help with threat hunting?**
Definitely. Your agent can run XQL queries to search through logs and network data to find specific patterns or malicious activity.

**Can the AI agent actually isolate a host?**
Yes, it can. If you confirm a machine is compromised, the agent can trigger the command to cut that host off from the network immediately.

**What happens if I need to see all my managed devices?**
The agent can pull a full list of your endpoints. This helps you audit your coverage or find specific hosts that need remediation.

**Is this Connector for real-time security monitoring?**
It's perfect for it. You can ask the agent to monitor the SOC queue and summarize high-severity incidents as they come in.