# Elastic Security MCP for AI Agents AI Agent Connect > Elastic Security MCP. Manage SIEM and SOC operations through your AI agent. Monitor detection rules, search security alerts, handle whitelisting, and audit threat coverage in real-time. Connect your Kibana environment to perform security audits and rule management without switching tabs. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/ai-agent-connect - **Tags:** siem, threat-detection, soc-operations, cybersecurity, alert-management, mitre-att-ck ## Description Elastic Security MCP lets you take over the heavy lifting of SOC operations by connecting your security stack directly to your AI agent. Instead of digging through complex Kibana dashboards, you can just ask your agent to find specific security signals or check if your detection rules actually cover recent CVEs. You can manage the lifecycle of your custom rules, creating new ones to catch malicious telemetry or purging old logic to keep your environment clean. If you're dealing with noisy alerts, you can quickly identify and add hostnames to exception lists to silence false positives in real time. This Connector gives you a way to audit your entire security posture through natural conversation. It's one of the many ways Vinkius helps you bridge the gap between your security stack and your daily workflow. You get to see your security signals with enriched data like user profiles and IP geolocations without having to manually join multiple datasets or jump between different screens. ## Tools ### find_detection_rules Search for active rules using specific names, tags, or MITRE ATT&CK tactics. This is great for auditing your security coverage. ### add_exception Add a hostname to an existing exception list to stop alerts from specific devices. This helps you resolve false positives quickly. ### create_rule Build a new log detection rule to track specific malicious telemetry in your environment. It generates risk scores against your assets. ### delete_rule Permanently remove a custom detection rule from your SIEM engine. Use this to purge logic that is no longer needed. ### list_exceptions View all global exception lists that currently bypass specific security rules. This helps you see what is being ignored. ### get_rule View the exact query logic, severity, and run intervals for a specific rule. It also provides links to threat intel reports. ### get_prepackaged_rules_status Check if your official Elastic prepackaged rules need updates for new threat models. It identifies gaps in your Windows or Linux security. ### list_detection_rules See every detection rule currently configured within your Elastic SIEM. This lets you map out your entire detection schema. ### search_signals Query raw security alerts to see enriched data like user profiles and IP geolocations. It consolidates multiple data points into one view. ### update_rule Enable or disable a specific detection rule to manage noise across your organization. Use this to tune triggers in real time. ## Prompt Examples **Prompt:** ``` Show me all active detection rules tagged with 'Ransomware'. ``` **Response:** ``` Searching rules... I found 12 active rules matching 'Ransomware'. | Rule Name | Severity | Tactic | | :--- | :--- | :--- | | Volume Shadow Copy Deletion | High | Impact | | Ransomware-linked Process Execution | Critical | Execution | Would you like to see the exact query logic for any of these? ``` **Prompt:** ``` Add hostname 'dev-machine-01' to exception list 'global-whitelist'. ``` **Response:** ``` Exception added! **'dev-machine-01'** has been whitelisted in **'global-whitelist'**. Detection rules bound to this list will now ignore telemetry from this host, which should resolve the false positives you were seeing. ``` **Prompt:** ``` Search for security signals from user 'admin_root' in the last hour. ``` **Response:** ``` Retrieving signals for **'admin_root'**... I found 2 alerts: * **Suspicious LDAP Query** at 10:15 AM * **Brute Force Attempt** at 10:45 AM I can provide the source IP and process tree for these signals if you'd like. ``` ## Capabilities ### Manage detection rules Create, update, and delete custom log detection rules to track malicious telemetry. ### Audit security signals Search raw security alerts enriched with hostnames, user profiles, and IP geolocations. ### Handle whitelisting Manage global exception lists to bypass rules for known-good administrative behavior. ### Check system health Verify if official prepackaged rules need updates to stay current with new threat models. ### Map threat coverage Find specific rules by tag or MITRE tactic to identify gaps in your security posture. ## Use Cases ### Rapid Alert Triage An analyst sees a spike in alerts and asks the agent to search_signals for a specific user to see the process tree and IP geolocations instantly. ### False Positive Suppression A security engineer uses add_exception to whitelist a vulnerability scanner that is triggering constant alerts, cleaning up the dashboard. ### Threat Coverage Audit A CISO asks the agent to find_detection_rules for Ransomware to see if the current rules cover the latest threat tactics and MITRE mappings. ### SIEM Health Monitoring A DevOps lead uses get_prepackaged_rules_status every morning to ensure the SIEM is running the latest official threat models for cloud environments. ## Benefits - Stop clicking through Kibana dashboards by using search_signals to pull enriched alert data directly into your chat. - Reduce false positives quickly by using add_exception to whitelist known-good hostnames without manual configuration. - Map your security posture to the MITRE ATT&CK framework by using find_detection_rules to identify coverage gaps. - Keep your SIEM clean by using delete_rule to remove outdated custom logic that no longer serves your security needs. - Stay ahead of new vulnerabilities by using get_prepackaged_rules_status to identify which official rules need updates. - Triage noisy alerts instantly by using update_rule to toggle detection rules on or off based on real-time environment needs. ## How It Works The bottom line is you can manage your entire SIEM operation through a chat interface instead of clicking through Kibana. 1. Subscribe to the Connector and gather your Kibana Host, Port, and API Key from your security settings. 2. Input your credentials into your AI client configuration to establish a direct connection. 3. Ask your agent to query signals, audit rules, or manage exceptions using plain English commands. ## Frequently Asked Questions **Can the Elastic Security MCP help me find specific security alerts?** Yes. You can ask your agent to search for signals based on users, hostnames, or specific timeframes. It will pull enriched data like IP geolocations and process trees directly into your chat. **How does the Elastic Security MCP handle false positives?** It allows you to manage exception lists. You can tell your agent to add specific hostnames to a whitelist so that known-good behavior stops triggering unnecessary alerts. **Can I use the Elastic Security MCP to audit my MITRE coverage?** Absolutely. You can search for rules based on specific MITRE ATT&CK tactics or tags to see exactly where your current detection logic stands. **Does the Elastic Security MCP support updating prepackaged rules?** It can check the status of official prepackaged rules. Your agent can identify if your environment is missing the latest threat models for Windows, Linux, or Cloud. **How do I manage detection rules with the Elastic Security MCP?** You can create new custom rules, update existing ones to tune noise, or delete old rules entirely using natural language commands through your AI client. **Can I see the logic behind a specific rule using the Elastic Security MCP?** Yes. You can ask your agent for the exact details of a rule, including its query logic, run intervals, and severity assignment. **Can my agent list all detection rules currently active in my SIEM?** Yes. Use the 'list_detection_rules' tool. It returns both custom rules and Elastic prepackaged ML algorithms, which is vital for mapping your MITRE ATT&CK coverage. **How do I whitelist a hostname to resolve a false positive via chat?** Use the 'add_exception' mutation. Provide the Exception List ID and the hostname string. The agent will update the container, implicitly ignoring telemetry matched on this host for any bound rule. **Can I search for security alerts (Signals) using KQL through the agent?** Absolutely. The 'search_signals' tool allows you to retrieve critical alert logs. You can provide an optional KQL query to filter for specific users, hostnames, or process trees within your security telemetry.