An astronaut overseeing a futuristic data hub
Download PDFMarkdown Version

Connect Cortex XSIAM to ChatGPT, Claude and Gemini

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Give your AI agent direct control over your security stack.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

A futuristic MCP client docking bay
V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 9 capabilities

We ship only the actions that matter.

Capability set01 / 03

01-03

3 capabilities in this set.

Part of 9 available through Cortex XSIAM.

  1. 01

    Execute playbook

    This capability runs automated incident response playbooks in Cortex XSIAM. You can use it to trigger actions like enriching IOCs, blocking IPs, or resetting passwords.

  2. 02

    Get alerts

    This capability pulls security alerts detected by Cortex XSIAM. Use it to review active detection rules or analyze emerging threat patterns.

  3. 03

    Get incidents

    This capability lists security incidents within your Cortex XSIAM environment. It allows you to monitor the SOC queue or track high-severity workloads.

Capability set02 / 03

04-06

3 capabilities in this set.

Part of 9 available through Cortex XSIAM.

  1. 04

    Get indicators

    This capability retrieves indicators of compromise (IOCs) tracked in the system. Use it to check if specific artifacts are known to be malicious.

  2. 05

    Get endpoints

    This capability lists all managed hosts and devices. It is useful for auditing endpoint coverage or finding disconnected hosts.

  3. 06

    Get incident details

    This capability fetches deep, specific information about a single security incident. You'll need the incident ID to perform a detailed investigation.

Capability set03 / 03

07-09

3 capabilities in this set.

Part of 9 available through Cortex XSIAM.

  1. 07

    Isolate endpoint

    This capability disconnects a specific endpoint from the network. Use it immediately if you confirm a host is compromised to stop lateral movement.

  2. 08

    Run xql query

    This capability executes XQL (Cortex Query Language) queries. It lets your agent perform custom threat hunting and data analysis across logs and network data.

  3. 09

    Scan endpoint

    This capability triggers a malware scan on a target host. You can choose between quick or deep scan types for a specific endpoint ID.

Real work

What teams actually run

01

Containment

When a threat is confirmed, your agent can isolate the host instantly to prevent lateral movement.

02

Threat Hunting

Use XQL queries to search for specific patterns or malicious artifacts across your entire environment.

03

Incident Triage

Have your agent pull incident details and IOCs to summarize what happened during a breach.

04

Endpoint Health Checks

Trigger malware scans or check endpoint status to ensure your fleet is secure and connected.

Automate a task

Put Cortex XSIAM to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

Cortex XSIAM works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

ClaudeClaudeChatGPTChatGPTGeminiGeminiPerplexityPerplexityGrokGrokMicrosoft CopilotMicrosoft CopilotCursorCursorVS CodeVS CodeWindsurfWindsurfJetBrainsJetBrainsClineClineLangChainLangChainVercel AI SDKVercel AI SDKLovableLovableZ.aiZ.aiRaycastRaycastQwen CodeQwen CodeKimi CodeKimi CodeLe ChatLe Chat

Building your own app? The connector is yours to use.

You don't need a client to put Cortex XSIAM to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

930ms average. Fast in production.

Cortex XSIAM is checked daily against the live service.

Daily averagePeak 1156ms
Oct 3Today
Fastest day
778ms
Slowest day
1156ms
14-day trend
Slowing+19%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 9 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of Cortex XSIAM, so you can see the experience inside your AI.

It does not authenticate your account with Cortex XSIAM. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

Cortex XSIAM Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Cortex XSIAM capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "cortex-xsiam-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up Cortex XSIAM in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work Cortex XSIAM owners hand off.

Security professionals who want to accelerate their response times using AI-driven workflows.

  • 01

    SOC Analysts

    They use the MCP to investigate alerts and run playbooks without switching capabilities.

  • 02

    Incident Responders

    They use the MCP to isolate compromised hosts and perform deep forensic queries.

  • 03

    Security Engineers

    They use the MCP to audit endpoint health and validate detection rules.

FAQ

Questions Cortex XSIAM owners ask.

  • 01

    Which AI clients can I use with this MCP?

    You can use any MCP-compatible client, including Claude, Cursor, Windsurf, and VS Code.

  • 02

    Do I need to host the MCP myself?

    No. Vinkius hosts and manages the MCP for you, so it is ready to use immediately after connection.

  • 03

    Can my AI agent actually take actions in Cortex XSIAM?

    Yes. The MCP includes capabilities like isolate_endpoint and execute_playbook that allow your agent to perform active response tasks.

  • 04

    How do I run custom queries?

    You can use the run_xql_query capability to send any valid XQL query string directly from your AI client.

  • 05

    Is my authentication handled securely?

    Yes. Vinkius manages your credentials and keeps the connection secure so you don't have to handle them manually in your client.

Explore

More in Other

Suggestions

Connect Cortex XSIAM to Claude, Cursor, ChatGPT & more