How to Use the Cortex XSIAM MCP in Cline

Q: Can Cline write code using real-time Cortex XSIAM alerts?

Yes. Cline calls getalerts to fetch live detection data and uses it to populate UI components or mock test suites directly in your workspace.

Q: How does Cline handle Cortex XSIAM endpoint isolation?

Cline invokes isolateendpoint with the targeted host ID after you approve the action in the VS Code sidebar. It then checks getendpoints to confirm the machine is successfully quarantined.

Q: Where do I store my Cortex XSIAM MCP Server credentials for Cline?

You store your credentials securely in the clinemcpsettings.json file. The MCP Server uses these credentials to authenticate requests to your security console.

Q: Can I run complex XQL threat hunts inside Cline?

Yes. Cline uses runxqlquery to send raw query strings to your data lake and processes the returned rows to find persistent threats.

Build custom security dashboards and automate incident triage in Cline using live Cortex XSIAM telemetry.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Cortex XSIAM MCP to Cline

Create your Vinkius account to connect Cortex XSIAM to Cline and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Cortex XSIAM with Cline

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Generate live security dashboards in Cline

`get_incidents` fetches the active SOC queue from your environment, returning severity levels, analyst assignments, and creation timestamps. Cline uses this tool to pull live incident data, drafts a React dashboard component, and writes the code using the Cortex XSIAM MCP Server to fetch live variables. The agent handles the entire lifecycle, from fetching the raw JSON to writing the frontend tests. You get a functional, live-updating triage board built right inside your VS Code workspace.

Investigate alerts and indicators of compromise

`get_alerts` retrieves the latest detection events from your security stack to pinpoint exactly where an attack started. Cline grabs these alerts, extracts the malicious hashes, and cross-references them using `get_indicators` to verify known-bad artifacts. Cline writes a markdown report summarizing the threat intelligence findings for your team. It chains these tools to build a complete picture of the incident without requiring manual search queries.

Audit managed endpoints directly from the sidebar

`get_endpoints` lists all managed hosts, their connection statuses, and operating system details. When Cline detects an anomaly, it pulls this host list, identifies unmanaged or disconnected systems, and highlights coverage gaps. If an endpoint shows signs of compromise, Cline grabs the specific details with `get_incident_details`. The connection is integrated via this MCP Server so you can check host metadata alongside the incident timeline and decide on containment.

Setup guide

Set up Cortex XSIAM MCP in Cline

Prerequisites

VS Code with Cline extension installed
Active Vinkius subscription with a valid endpoint token

1

Open Cline MCP settings

Click the Cline icon in the VS Code sidebar to open the Cline panel. Then click the MCP Servers icon (server stack) at the top-right corner of the panel.
2

Add a remote server

Click "Remote Servers" at the top, then click "Add Remote MCP". In the Name field, type cortex-xsiam-mcp. In the URL field, paste your Vinkius endpoint: https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp. Get your token from cloud.vinkius.com.
3

Enable the server

After saving, the server appears in the Cline MCP panel. Toggle the switch to enable it. The status indicator turns green when the connection is live.
4

Start using tools

Return to the Cline chat and ask: "Check my latest Cortex XSIAM refund status." Cline will discover the available tools and request your approval before invoking each one — giving you full control over every action.

Cline MCP Settings

{
  "mcpServers": {
    "cortex-xsiam-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Cortex XSIAM. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Cortex XSIAM now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Cortex XSIAM MCP in Cline

Yes. Cline calls `get_alerts` to fetch live detection data and uses it to populate UI components or mock test suites directly in your workspace.

Cline invokes `isolate_endpoint` with the targeted host ID after you approve the action in the VS Code sidebar. It then checks `get_endpoints` to confirm the machine is successfully quarantined.

You store your credentials securely in the `cline_mcp_settings.json` file. The MCP Server uses these credentials to authenticate requests to your security console.

Yes. Cline uses `run_xql_query` to send raw query strings to your data lake and processes the returned rows to find persistent threats.

No. Your endpoint lists, security alerts, and playbook arguments are processed inside a zero-trust, ephemeral sandbox. No security telemetry is saved or used for model training.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript