Download PDFMarkdown Version
ClaudeChatGPTPerplexityGeminiMicrosoft CopilotRaycastMeta AIGrokZ.aiQwenKimi
DeepSeekMistralCursorVS CodeWindsurfJetBrainsClineLovableVercel AI SDKLangChain

Use Elastic Security with your AI.

Connect your account once and let the AI you already use work with it, without building another integration. Manage SIEM and SOC operations via Elastic Security. monitor detection rules, search security alerts (Signals), handle whitelisting, and audit threat coverage

Included with plan

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Complete set · 10 capabilities

The complete Elastic Security capability set.

These are the exact actions your AI can choose when you ask it to work with Elastic Security.

Capability set01 / 03

01-04

4 capabilities in this set.

Part of 10 available through Elastic Security.

  1. 01

    Find detection rules

    Expedites SOC auditing when evaluating coverage for newly reported CVEs or specific localized threats. Search for specific Elastic rules by name, tag or MITRE tactic

  2. 02

    Add exception

    Name value to the target exception container, implicitly ignoring telemetry matched on this field for any rule bound to the list. Use explicitly to resolve false positives. Whitelist a hostname inside an existing Exception List

  3. 03

    Create rule

    Defines immediate risk scores multiplying against asset valuations, generating Elastic Signals tracking MITRE TTPs upon match. Create a new Log Detection Rule tracking malicious Elastic telemetry

  4. 04

    Delete rule

    Cannot be applied to Elastic Pre-built rules which are managed globally via package updates. Irreversible. Hard-delete a custom Elastic detection rule completely

Capability set02 / 03

05-07

3 capabilities in this set.

Part of 10 available through Elastic Security.

  1. 05

    List exceptions

    These lists logically bypass specific rules, preventing SIEM alerts from triggering on known-good administrative behavior like vulnerability scanners. List globalThis exception lists managing detection bypass logic

  2. 06

    Get prepackaged rules status

    Identifies if the environment is lacking the latest official threat models targeting Windows, Linux, and Cloud environments. Check if official Elastic prepackaged rules need updates

  3. 07

    Get rule

    Displays run intervals, severity assignment, index scopes, and explicit reference URLs matching threat intel reports. Get exact details, intervals, and query logic for a distinct Rule

Capability set03 / 03

08-10

3 capabilities in this set.

Part of 10 available through Elastic Security.

  1. 08

    List detection rules

    G., logs-endpoint, winlogbeat). Vital for mapping MITRE ATT&CK coverage against the Elastic schema. List all detection rules configured within the Elastic SIEM

  2. 09

    Search signals

    Signals consolidate the triggering payload structure, enriching it with Hostname, User profiles, IP geolocations, and process trees. Search raw generated Elastic Security alerts (Signals)

  3. 10

    Update rule

    Used explicitly to disable noisy rules triggering false positives across large organizational units, or to re-enable them post-tuning. Enable or Disable an existing Elastic Detection Rule

Observed, not estimated

811ms average. Fast in production.

Elastic Security is checked daily against the live service.

Daily averagePeak 1061ms
Aug 25Today
Fastest day
740ms
Slowest day
1061ms
14-day trend
Slowing+9%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 10 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of Elastic Security, so you can see the experience inside your AI.

It does not authenticate your account with Elastic Security. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

Elastic Security Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Elastic Security capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "elastic-security-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

FAQ

Questions Elastic Security owners ask.

  • 01

    Can my agent list all detection rules currently active in my SIEM?

    Yes. Use the 'list_detection_rules' capability. It returns both custom rules and Elastic prepackaged ML algorithms, which is vital for mapping your MITRE ATT&CK coverage.

  • 02

    How do I whitelist a hostname to resolve a false positive via chat?

    Use the 'add_exception' mutation. Provide the Exception List ID and the hostname string. The agent will update the container, implicitly ignoring telemetry matched on this host for any bound rule.

  • 03

    Can I search for security alerts (Signals) using KQL through the agent?

    Absolutely. The 'search_signals' capability allows you to retrieve critical alert logs. You can provide an optional KQL query to filter for specific users, hostnames, or process trees within your security telemetry.

Explore

More in Fort Knox

Suggestions