# Lacework MCP for AI Agents AI Agent Connect

> Lacework (Cloud Security & CNAPP) MCP connects your Lacework account to your AI client so you can hunt threats and audit cloud assets without jumping between tabs. It lets you query security alerts, track CVEs across your infrastructure, and audit your cloud inventory in real-time.

## Overview
- **Category:** fort-knox
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_xT38bIhhFhzvvpfxyO01Dv9Iop7sXt66wD8neHzv/ai-agent-connect
- **Tags:** cnapp, threat-detection, vulnerability-scanning, cloud-security, kubernetes-security, iam-auditing

## Description

This Connector lets you manage your entire cloud security posture and hunt for threats through natural conversation. Instead of digging through dashboards to find out why a Kubernetes pod is acting up or which S3 buckets are public, you just ask. It handles the heavy lifting of vulnerability management by listing critical CVEs on your hosts and checking your container registries for issues before they hit production. If a zero-day like Log4j hits, you can scan your whole footprint to see exactly where you're exposed. You can also run custom queries to find API key abuse or weird login patterns. This is a core part of the Vinkius catalog, letting you bring Lacework's security data into your existing AI workflow. You get a clear picture of your networking perimeters and compliance status without manual auditing.

## Tools

### get_alert
Get behavioral payloads and telemetry for a specific alert, including AWS accounts and container SHAs.

### list_host_vulnerabilities
See which running processes on EC2 or GCE instances are currently active with high-risk CVEs.

### search_alerts
Fetch events for Kubernetes anomalies, IAM brute-forcing, and container network exfiltration.

### search_cve_exposure
Filter your entire infrastructure to find specific machines vulnerable to a designated CVE.

### list_security_policies
View all global cloud security policies to confirm if structural norms are being enforced.

### list_lql_queries
Extract telemetry fields that map your user-defined compliance checks against the dataset.

### list_resource_groups
See how your architecture is organized into logical groups like Production or Staging.

### execute_query
Run a custom LQL threat hunting query to track API key abuse or process spawn trees.

### list_container_vulnerabilities
Check ECR or DockerHub registries for images with critical inherited CVEs.

### search_cloud_inventory
Query the real-time cloud control-plane to find running instances and unrestricted S3 buckets.

## Prompt Examples

**Prompt:** 
```
Find all instances currently running with the Log4j vulnerability.
```

**Response:** 
```
### Vulnerability Scan Results
I've scanned your infrastructure for the **Log4j** CVE. Here are the affected nodes:

| Machine ID | IP Address | Status |
| :--- | :--- | :--- |
| i-0a1b2c3d | 192.168.1.45 | Active |
| i-0f9e8d7c | 10.0.2.112 | Active |

**Next steps:**
- I can provide remediation steps for these specific instances.
- I can check the security policies for these groups.
```

**Prompt:** 
```
Are there any public S3 buckets in our production environment?
```

**Response:** 
```
### Cloud Inventory Audit
I've checked your cloud control-plane. I found **2** unrestricted S3 buckets:

*   **public-assets-prod** (Allow: World-Readable)
*   **temp-data-dump** (Allow: World-Readable)

Would you like to see the security policies associated with these buckets?
```

**Prompt:** 
```
Show me the telemetry for the most recent Kubernetes alert.
```

**Response:** 
```
### Alert Telemetry: Anomalous K8s Execution
Here is the deep behavioral data for the alert triggered at 14:22 UTC:

*   **Offending Container:** `web-app-prod-7f2d`
*   **Image SHA:** `sha256:a3f2b1...`
*   **Source IP:** `192.168.5.102`
*   **Action:** `exec` into shell
*   **AWS Account:** `123456789012`

This matches a known pattern for lateral movement.
```

## Capabilities

### Search for security alerts
Find anomalous Kubernetes executions or AWS IAM brute-force attempts instantly.

### Identify host vulnerabilities
See which running processes on EC2 or GCE instances are currently hit by critical CVEs.

### Audit cloud inventory
List your running instances, S3 buckets, and networking perimeters in real-time.

### Scan container registries
Check ECR and DockerHub for images with filesystem-level vulnerabilities.

### Run custom threat hunting
Execute LQL queries to find API key abuse or login anomalies.

### Audit security policies
Check your global cloud policies for compliance violations.

## Use Cases

### Zero-day response
A security lead needs to know if Log4j is a threat. They ask the agent to check all instances using `search_cve_exposure`.

### IAM Audit
An admin suspects API key abuse. They use `execute_query` to run an LQL query and find the offending patterns.

### S3 Leak Check
A compliance officer wants to find public buckets. They use `search_cloud_inventory` to audit the entire cloud control-plane.

### Registry Cleanup
A DevOps engineer wants to block bad images. They use `list_container_vulnerabilities` to scan DockerHub before a deployment.

## Benefits

- Stop manual dashboard hunting by using `search_alerts` to find Kubernetes and IAM anomalies instantly.
- Identify zero-day risks faster with `search_cve_exposure` to pinpoint every vulnerable node in your footprint.
- Secure your CI/CD pipeline by using `list_container_vulnerabilities` to catch issues in ECR and DockerHub.
- Get deep context on every alert with `get_alert` to see the exact AWS accounts and container SHAs involved.
- Maintain continuous compliance by auditing global rules with `list_security_policies` and `list_lql_queries`.

## How It Works

The bottom line is you get a conversational interface for your cloud security operations.

1. Subscribe to this Connector on Vinkius
2. Provide your Lacework Account, Key ID, and Secret
3. Ask your AI client to find vulnerabilities or audit your cloud assets

## Frequently Asked Questions

**Can Lacework MCP help me find zero-day vulnerabilities?**
Yes, it allows your AI agent to scan your entire infrastructure for specific CVEs, helping you identify exposed nodes during zero-day events.

**How does Lacework MCP handle container security?**
It can scan your ECR and DockerHub registries for images with critical vulnerabilities before they are promoted to production.

**Can I use Lacework MCP for compliance audits?**
Yes, you can use it to list and audit all global cloud security policies to ensure your infrastructure meets regulatory requirements.

**Does Lacework MCP support LQL queries?**
Yes, it can execute custom Lacework Query Language (LQL) requests to hunt for API key abuse or anomalous login patterns.

**How do I connect Lacework to my AI agent?**
You can subscribe to this Connector through Vinkius, provide your Lacework account credentials, and then start asking questions in your preferred AI client.

**Can it find public S3 buckets?**
Yes, the Connector can query your cloud control-plane inventory to find unrestricted S3 buckets across your accounts.

**Can I search for specific CVE exposure across my whole cloud environment?**
Yes. Use the `search_cve_exposure` tool and provide the official CVE ID (e.g. CVE-2023-1234). Your agent will filter the entire cloud footprint to determine exactly which specific nodes or machines are currently vulnerable.

**How do I investigate the behavioral telemetry of a specific security alert?**
The `get_alert` tool extracts precisely what baseline behavior was deviated from for a specific Alert ID. Your agent will return detailed contextual metadata, including offending container SHAs and correlated IP anomalies.

**Can my agent run custom threat hunting queries using LQL?**
Absolutely. Use the `execute_query` tool to run specialized Lacework Query Language (LQL) blocks. This allows your agent to perform complex mathematical analysis on cloud telemetry to identify deep security patterns.