An astronaut overseeing a futuristic data hub
Download PDFMarkdown Version

Connect Elastic Security to ChatGPT, Claude and Gemini

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Run your entire SIEM workflow through a chat interface.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

A futuristic MCP client docking bay
V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 10 capabilities

We ship only the actions that matter.

Capability set01 / 03

01-04

4 capabilities in this set.

Part of 10 available through Elastic Security.

  1. 01

    Find detection rules

    This capability searches for Elastic rules by name, tag, or MITRE tactic. It helps you quickly evaluate if you have coverage for specific CVEs or localized threats.

  2. 02

    Add exception

    Use this to whitelist a hostname within an existing exception list. It tells the SIEM to ignore telemetry from that specific host for any rules tied to that list.

  3. 03

    Create rule

    This capability creates a new Log Detection Rule to track malicious telemetry. It generates Elastic Signals that map to MITRE TTPs upon a match.

  4. 04

    Delete rule

    This capability performs a hard-delete of a custom Elastic detection rule. Note that you cannot use this on official pre-built rules.

Capability set02 / 03

05-07

3 capabilities in this set.

Part of 10 available through Elastic Security.

  1. 05

    List exceptions

    This capability retrieves all global exception lists. These lists are used to bypass specific rules and prevent alerts from triggering on known-good behavior.

  2. 06

    Get prepackaged rules status

    Use this to check if your official Elastic prepackaged rules need updates. It identifies if your environment is missing the latest threat models for Windows, Linux, or Cloud.

  3. 07

    Get rule

    This capability pulls specific details for a single rule. You can see its run intervals, severity, index scopes, and query logic.

Capability set03 / 03

08-10

3 capabilities in this set.

Part of 10 available through Elastic Security.

  1. 08

    List detection rules

    This capability lists every detection rule configured in your Elastic SIEM. It is useful for mapping your total MITRE ATT&CK coverage.

  2. 09

    Search signals

    This capability searches raw Elastic Security alerts, also known as Signals. It returns enriched data including hostnames, user profiles, and IP geolocations.

  3. 10

    Update rule

    Use this to enable or disable existing detection rules. It is the fastest way to silence noisy triggers or reactivate rules after tuning.

Real work

What teams actually run

01

CVE Response

Quickly search for existing rules by name or tag to see if you are protected against a newly reported vulnerability.

02

False Positive Suppression

Immediately whitelist a specific hostname in an exception list to stop a noisy rule from firing.

03

Active Threat Hunting

Search for security signals from a specific user or IP to trace the movement of an attacker.

04

Detection Engineering

Create new custom log detection rules to track specific malicious telemetry patterns.

Automate a task

Put Elastic Security to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

Elastic Security works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

ClaudeClaudeChatGPTChatGPTGeminiGeminiPerplexityPerplexityGrokGrokMicrosoft CopilotMicrosoft CopilotCursorCursorVS CodeVS CodeWindsurfWindsurfJetBrainsJetBrainsClineClineLangChainLangChainVercel AI SDKVercel AI SDKLovableLovableZ.aiZ.aiRaycastRaycastQwen CodeQwen CodeKimi CodeKimi CodeLe ChatLe Chat

Building your own app? The connector is yours to use.

You don't need a client to put Elastic Security to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

970ms average. Fast in production.

Elastic Security is checked daily against the live service.

Daily averagePeak 1193ms
Oct 3Today
Fastest day
747ms
Slowest day
1193ms
14-day trend
Slowing+22%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 10 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of Elastic Security, so you can see the experience inside your AI.

It does not authenticate your account with Elastic Security. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

Elastic Security Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Elastic Security capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "elastic-security-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up Elastic Security in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work Elastic Security owners hand off.

This MCP is built for security professionals who need to interact with their SIEM without manual dashboard navigation.

  • 01

    SOC Analysts

    They use the agent to monitor alerts and audit rules without leaving their chat interface.

  • 02

    Security Engineers

    They use natural language to create new detection logic and manage exception lists.

  • 03

    Incident Responders

    They use the agent to quickly search for signals and verify threat coverage during active investigations.

FAQ

Questions Elastic Security owners ask.

  • 01

    How do I connect my Elastic environment?

    You need your Kibana Host, Port, and an Elastic API Key. You can find the API key in Kibana under Stack Management, Security, and then API Keys.

  • 02

    Can I delete official Elastic prepackaged rules?

    No. The delete capability only works for custom rules you have created. Prepackaged rules are managed globally via package updates.

  • 03

    What kind of data can the AI see in security signals?

    The agent can access enriched signal data including hostnames, user profiles, IP geolocations, and process trees.

  • 04

    Is this MCP compatible with any AI client?

    Yes, it works with any MCP-compatible client including Claude, Cursor, and Windsurf.

  • 05

    How do I stop a rule from firing too often?

    You can use the update capability to disable a noisy rule or use the add exception capability to whitelist specific hostnames.

  • 06

    Can my agent list all detection rules currently active in my SIEM?

    Yes. Use the 'list_detection_rules' capability. It returns both custom rules and Elastic prepackaged ML algorithms, which is vital for mapping your MITRE ATT&CK coverage.

  • 07

    How do I whitelist a hostname to resolve a false positive via chat?

    Use the 'add_exception' mutation. Provide the Exception List ID and the hostname string. The agent will update the container, implicitly ignoring telemetry matched on this host for any bound rule.

  • 08

    Can I search for security alerts (Signals) using KQL through the agent?

    Absolutely. The 'search_signals' capability allows you to retrieve critical alert logs. You can provide an optional KQL query to filter for specific users, hostnames, or process trees within your security telemetry.

Explore

More in Fort Knox

Suggestions

Connect Elastic Security to Claude, Cursor, ChatGPT & more