Elastic Security MCP Server

add_exception

name value to the target exception container, implicitly ignoring telemetry matched on this field for any rule bound to the list. Use explicitly to resolve false positives. Whitelist a hostname inside an existing Exception List

create_rule

Defines immediate risk scores multiplying against asset valuations, generating Elastic Signals tracking MITRE TTPs upon match. Create a new Log Detection Rule tracking malicious Elastic telemetry

delete_rule

Cannot be applied to Elastic Pre-built rules which are managed globally via package updates. Irreversible. Hard-delete a custom Elastic detection rule completely

find_detection_rules

Expedites SOC auditing when evaluating coverage for newly reported CVEs or specific localized threats. Search for specific Elastic rules by name, tag or MITRE tactic

get_prepackaged_rules_status

Identifies if the environment is lacking the latest official threat models targeting Windows, Linux, and Cloud environments. Check if official Elastic prepackaged rules need updates

get_rule

Displays run intervals, severity assignment, index scopes, and explicit reference URLs matching threat intel reports. Get exact details, intervals, and query logic for a distinct Rule

list_detection_rules

g., logs-endpoint*, winlogbeat*). Vital for mapping MITRE ATT&CK coverage against the Elastic schema. List all detection rules configured within the Elastic SIEM

list_exceptions

These lists logically bypass specific rules, preventing SIEM alerts from triggering on known-good administrative behavior like vulnerability scanners. List global exception lists managing detection bypass logic

search_signals

Signals consolidate the triggering payload structure, enriching it with Hostname, User profiles, IP geolocations, and process trees. Search raw generated Elastic Security alerts (Signals)

update_rule

Used explicitly to disable noisy rules triggering false positives across large organizational units, or to re-enable them post-tuning. Enable or Disable an existing Elastic Detection Rule