• DETECTION
  • TRACKING
  • TRIAGE
  • HUMAN

How to review security audit logs with your AI

Connect Kolide to your AI client once. From there, you can query your entire security event history using natural language.

Ask AI about this page

Short answer

How can I review Kolide security logs with AI?

Your AI uses the list_kolide_audit_logs tool to pull administrative and security event histories from your Kolide environment. You can then ask your agent to find specific patterns, track user changes, or flag suspicious actions. This breakdown shows how to manage those queries.

Where your data lands.

Audit outcomes.

The AI processes the raw logs and organizes the findings into these categories.

DETECTION

Security event summaries

The AI scans the logs for specific security events. You get a clear list of what happened and when.

TRACKING

Admin change history

The agent tracks every administrative action taken in the environment. This helps you see who changed what settings.

TRIAGE

Anomalous activity alerts

The AI identifies unusual patterns in the audit trail. You receive a summary of events that look out of the ordinary.

HUMAN

Manual investigation

The AI flags specific log entries that require your direct attention. You decide which events need a deeper look or a formal response.

The workflow

What your AI does when the logs arrive.

The AI handles the heavy lifting of searching through massive log files so you don't have to.

  1. Fetch logs

    The AI pulls the latest administrative and security event histories from your Kolide account.

    list_kolide_audit_logs

  2. Filter events

    Your agent narrows down the massive list to only the specific actions or users you care about.

    list_kolide_audit_logs

  3. Identify patterns

    The AI looks for repeated actions or unauthorized changes within the retrieved data.

    list_kolide_audit_logs

  4. Report findings

    The agent presents a clean summary of the audit trail, highlighting the most important changes.

    list_kolide_audit_logs

Try it

Copy these to start.

Use these prompts to begin your investigation.

Starting points

These are templates. Swap out the bracketed text with your specific user names or timeframes.

Kolide Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_IxpJHD6HTbvQIvcvAz5O4PvMjzMVYwv1YW8pZf8H/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Kolide capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "kolide-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_IxpJHD6HTbvQIvcvAz5O4PvMjzMVYwv1YW8pZf8H/mcp"
    }
  }
}
Copy into chat04

  • List the last 10 administrative actions taken in Kolide.

  • Show me all security events related to user 'alex_security' from yesterday.

  • Were there any changes to system settings in the last 24 hours?

  • Find all audit logs that indicate a change in user permissions.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Kolide once, then ask.

Just follow the link to connect your account. Your credentials stay encrypted and secure, and you can immediately start querying logs in your preferred AI client.

Connect Kolide to your AI

FAQ

How this task behaves.

  • 01

    Can the AI change settings in Kolide?

    No. The AI can only read audit logs. It cannot modify your Kolide configuration or change user permissions.

  • 02

    Does the AI delete any logs?

    No. The AI has read-only access to your audit history through the list_kolide_audit_logs tool.

  • 03

    How far back can the AI look?

    The AI can access whatever history is available in your Kolide audit logs via the provided tool.

  • 04

    Can I use this with Claude?

    Yes, as long as you are using an MCP-compatible client like Claude Desktop.

  • 05

    Will the AI alert me automatically?

    No. The AI only responds when you ask it a question or give it a command in your chat interface.

  • More questions about Kolide? See everything the Kolide Connector can do

Connect Kolide to Claude, Cursor, ChatGPT & more