Elastic Security MCP Server

name value to the target exception container, implicitly ignoring telemetry matched on this field for any rule bound to the list. Use explicitly to resolve false positives. Whitelist a hostname inside an existing Exception List

Defines immediate risk scores multiplying against asset valuations, generating Elastic Signals tracking MITRE TTPs upon match. Create a new Log Detection Rule tracking malicious Elastic telemetry

Cannot be applied to Elastic Pre-built rules which are managed globally via package updates. Irreversible. Hard-delete a custom Elastic detection rule completely

Expedites SOC auditing when evaluating coverage for newly reported CVEs or specific localized threats. Search for specific Elastic rules by name, tag or MITRE tactic

Identifies if the environment is lacking the latest official threat models targeting Windows, Linux, and Cloud environments. Check if official Elastic prepackaged rules need updates

Displays run intervals, severity assignment, index scopes, and explicit reference URLs matching threat intel reports. Get exact details, intervals, and query logic for a distinct Rule

g., logs-endpoint*, winlogbeat*). Vital for mapping MITRE ATT&CK coverage against the Elastic schema. List all detection rules configured within the Elastic SIEM

These lists logically bypass specific rules, preventing SIEM alerts from triggering on known-good administrative behavior like vulnerability scanners. List global exception lists managing detection bypass logic

Signals consolidate the triggering payload structure, enriching it with Hostname, User profiles, IP geolocations, and process trees. Search raw generated Elastic Security alerts (Signals)

Used explicitly to disable noisy rules triggering false positives across large organizational units, or to re-enable them post-tuning. Enable or Disable an existing Elastic Detection Rule