How to Use the Cortex XSIAM MCP in LlamaIndex

Ground your LlamaIndex knowledge base in live security data using the Cortex XSIAM MCP Server.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect Cortex XSIAM MCP to LlamaIndex

Create your Vinkius account to connect Cortex XSIAM to LlamaIndex and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup Cortex XSIAM with LlamaIndex

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Index security alerts for RAG

Pull data from `get_alerts` and inject it directly into your LlamaIndex vector store. This turns fleeting detection events into a searchable history of your network security. Your RAG application can then answer questions about past incidents. You stop relying on generic training and start grounding answers in actual evidence.

Endpoint visibility for LlamaIndex

Use `get_endpoints` to maintain an updated index of every host in your environment. When you ask about specific device coverage, the system knows exactly what is managed. It allows for fast lookups during an audit. You verify your security posture by querying the index instead of scrolling through lists.

Deep investigation of incidents

Fetch detailed records using `get_incident_details` and append them to your knowledge base. This creates a repository of case studies for your security team. You can query this index to see how similar incidents were handled in the past. It turns raw log data into a reference library for your agents.

Setup guide

Set up Cortex XSIAM MCP in LlamaIndex

Prerequisites

Python 3.10+ installed
llama-index-tools-mcp package
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install llama-index-tools-mcp llama-index-llms-openai. The MCP tools package provides BasicMCPClient and McpToolSpec.
2

Connect with BasicMCPClient
Point BasicMCPClient to your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. Supports SSE and Streamable HTTP transports.
3

Convert to LlamaIndex tools
Call mcp_tool_spec.to_tool_list_async() to convert all Cortex XSIAM MCP tools into native FunctionTool objects that any LlamaIndex agent can use.
4

Run with any LLM
Create a FunctionAgent with the tools and your preferred LLM. Swap OpenAI for Anthropic, Gemini, or any LlamaIndex-supported provider.

agent.py

from llama_index.tools.mcp import BasicMCPClient, McpToolSpec
from llama_index.core.agent.workflow import FunctionAgent
from llama_index.llms.openai import OpenAI

# Connect to the MCP
mcp_client = BasicMCPClient(
    "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)
mcp_tool_spec = McpToolSpec(client=mcp_client)

# Convert MCP tools to LlamaIndex tools
tools = await mcp_tool_spec.to_tool_list_async()

# Create and run the agent
agent = FunctionAgent(
    tools=tools,
    llm=OpenAI(model="gpt-4o"),
    system_prompt="You have access to Cortex XSIAM tools.",
)
response = await agent.run("List recent Cortex XSIAM data")

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Cortex XSIAM. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect Cortex XSIAM now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about Cortex XSIAM MCP in LlamaIndex

You use the MCP tool spec to fetch data and ingest it into your index. This makes the security information searchable alongside your existing documents.

Yes, you can specify exactly which tools are available to the agent. This restricts the agent to only the capabilities you want it to use.

By indexing the tool outputs, you create a history of past sessions. You can then run queries against this index to retrieve previous incident details.

The server uses a dedicated endpoint token to authenticate. All data requests are scoped to your specific environment and remain isolated.

Access to host IDs is restricted to authenticated requests only. The server does not store this sensitive inventory data, it only retrieves it on demand for your agent.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript