• ANALYSIS
  • MANAGEMENT
  • TRIAGE
  • HUMAN

How to audit security events with your AI

Connect Logz.io to your AI client to turn plain English questions into precise security investigations and rule management.

Ask AI about this page

Short answer

Can I audit security events using natural language?

Yes. You can ask your AI to search through event logs, inspect specific security rules, or modify lookup lists. This allows you to move from a suspicious trigger to a full investigation. You'll see how the AI handles each step below.

Investigation outcomes

Where your investigation leads.

The AI handles the heavy lifting of querying and updating, leaving you to make the final calls.

ANALYSIS

Deep log inspection

Your AI pulls specific event logs and security data based on your descriptions. You get the raw data needed to confirm a threat.

MANAGEMENT

Rule and list updates

The AI can modify existing SIEM rules or update lookup lists. This lets you adjust your defenses as soon as you find a gap.

TRIAGE

Trigger investigation

When a rule hits, your AI finds the exact logs tied to that trigger. You get a clear picture of what happened and why.

HUMAN

Final decision making

The AI prepares the data and the proposed rule changes. You review the findings and decide whether to commit the updates.

The workflow

What your AI does when the trigger arrives.

The AI acts as a bridge between your natural language intent and the Logz.io API.

  1. Identify the threat

    The AI looks for specific patterns or triggers within your security data to find what matters.

    search_security_events

  2. Deep dive into logs

    Once a threat is identified, the AI pulls the granular log details to provide context for the event.

    search_security_event_logs

  3. Inspect existing logic

    The AI checks your current security rules and lookup lists to see how they relate to the event.

    search_security_rulesget_lookup_list

  4. Adjust defenses

    The AI proposes or executes changes to your rules or lists to block future occurrences.

    create_security_ruleupdate_security_ruledelete_security_rule

Try it

Copy these to start.

Use these prompts to kick off an investigation or a rule change.

Starting points

These are opening lines. Swap out the specific rule names or log types for your own environment.

Logz.io Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_AyHNLvDaCmsIfrOJPVFCkVxu65F4CtNzZtKWGH3a/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Logz.io capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "logzio-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_AyHNLvDaCmsIfrOJPVFCkVxu65F4CtNzZtKWGH3a/mcp"
    }
  }
}
Copy into chat04

  • Show me the last ten security events related to failed admin logins.

  • Find the security rule that triggered the alert for the suspicious IP address.

  • Update the 'blocked_ips' lookup list to include 192.168.1.50.

  • Create a new security rule to alert me whenever a user from the marketing group accesses the production database.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Logz.io once, then ask.

You only need to link your account once. Your credentials stay encrypted, and you can immediately start chatting with your security data.

Connect Logz.io to your AI

FAQ

How this task behaves

  • 01

    Can the AI delete my security rules automatically?

    The AI can use the delete tool if you explicitly tell it to, but it will typically present the action for your approval first.

  • 02

    Does the AI write the queries for me?

    Yes. You provide the intent in plain English, and the AI translates that into the necessary tool calls to fetch your logs and rules.

  • 03

    Can the AI create new users in Logz.io?

    No. This MCP is limited to security events, rules, and lookup lists. It cannot manage user accounts or permissions.

  • 04

    Will the AI change my rules without asking?

    No. While the AI has the capability to update or create rules, you remain the decision maker in your AI client.

  • 05

    Can I use this to search through raw system logs?

    Yes, as long as those logs are being ingested into Logz.io and are accessible via the security event tools.

  • More questions about Logz.io? See everything the Logz.io Connector can do

Connect Logz.io to Claude, Cursor, ChatGPT & more