Cortex XSIAM Connector for AI agents.
9 live capabilities
Manage security incidents and threat hunting from your AI chat.
Waiting for input…
Why people use Cortex XSIAM
Cortex XSIAM Security Operations and Incident Response
This Connector changes the workflow by putting the power of Cortex XSIAM directly into your AI agent. You can ask your agent to find the threat, pull the incident details, and trigger the response playbook in a single conversation. You stop being a data mover and start being a decision maker.
What Vinkius changes
You get a direct line from your AI agent to your security operations data and actions.
Use it from Claude, ChatGPT, Cursor or another AI client you already have.
One account · 5,900+ Connectors
- Real-world use case 01
Suspicious login triage
An alert fires for a suspicious login.
- Real-world use case 02
Ransomware containment
A host is confirmed to have ransomware.
- Real-world use case 03
IP hunting
You need to find a specific IP in the logs.
Complete set · 9capabilities
The complete Cortex XSIAM capability set.
These are the exact actions your AI can choose when you ask it to work with Cortex XSIAM.
01—03
3 capabilities in this set.
Part of 9 available through Cortex XSIAM.
- 01 Capability
Execute playbook
Run automated incident response playbooks to handle common security tasks quickly.
- 02 Capability
Get alerts
List the security alerts currently detected by your Cortex XSIAM environment.
- 03 Capability
Scan endpoint
Trigger a quick or deep malware scan on a specific managed device.
04—06
3 capabilities in this set.
Part of 9 available through Cortex XSIAM.
- 04 Capability
Get endpoints
View all managed hosts and devices currently tracked in your system.
- 05 Capability
Get incident details
Fetch comprehensive information about a specific security incident using its ID.
- 06 Capability
Get incidents
List all active security incidents and monitor your SOC queue.
07—09
3 capabilities in this set.
Part of 9 available through Cortex XSIAM.
- 07 Capability
Get indicators
Retrieve indicators of compromise to check for known malicious artifacts.
- 08 Capability
Isolate endpoint
Remove a specific compromised host from the network to stop lateral movement.
- 09 Capability
Run xql query
Execute XQL queries to perform advanced threat hunting and data analysis.
Set up in minutes
One URL. Then ask Cortex XSIAM to work.
Claude and ChatGPT only need the Connector URL. Copy it once, add it in settings, and use Cortex XSIAM from the conversation.
Choose your client
Live previewAdvanced clients IDE · CLI
Claude · Web + desktop
Connector URL · ready to paste
Streamable HTTPhttps://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/mcp - Step 01
Open Connectors
In Claude Web or Claude Desktop, open Settings and choose Connectors.
- Step 02
Add the URL
Choose Add custom connector, name it Cortex XSIAM, and paste the URL above.
- Step 03
Turn it on in chat
Select +, open Connectors, and enable Cortex XSIAM for the conversation.
ChatGPT · Web + desktop
Connector URL · ready to paste
Streamable HTTPhttps://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/mcp - Step 01
Open MCP settings
On desktop, open Settings and MCP servers. On web, open your workspace app or connector settings.
- Step 02
Add the URL
Choose Add server with Streamable HTTP, or create a custom MCP app, then paste the Cortex XSIAM URL.
- Step 03
Save and start
Save the connection and enable Cortex XSIAM in your conversation. Desktop may ask you to restart once.
Cursor · IDE configuration
Advanced setup
{
"mcpServers": {
"cortex-xsiam": {
"url": "https://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/mcp"
}
}
}- Step 01
Open MCP Settings
Press Cmd+Shift+P (macOS) or Ctrl+Shift+P (Windows/Linux) → search "MCP Settings"
- Step 02
Add the server config
Paste the JSON configuration above into the mcp.json file that opens
- Step 03
Save the file
Cursor will automatically detect the new Connector
- Step 04
Start using Cortex XSIAM
Open Agent mode in chat and ask: "Using Cortex XSIAM, help me...". 9 tools available
VS Code Copilot · IDE configuration
Advanced setup
{
"mcpServers": {
"cortex-xsiam": {
"url": "https://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/mcp"
}
}
}- Step 01
Create MCP config
Create a .vscode/mcp.json file in your project root
- Step 02
Add the server config
Paste the JSON configuration above
- Step 03
Enable Agent mode
Open GitHub Copilot Chat and switch to Agent mode using the dropdown
- Step 04
Start using Cortex XSIAM
Ask Copilot: "Using Cortex XSIAM, help me...". 9 tools available
Windsurf · IDE configuration
Advanced setup
{
"mcpServers": {
"cortex-xsiam": {
"url": "https://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/mcp"
}
}
}- Step 01
Open MCP Settings
Go to Settings → MCP Configuration or press Cmd+Shift+P and search "MCP"
- Step 02
Add the server
Paste the JSON configuration above into mcp_config.json
- Step 03
Save and reload
Windsurf will detect the new server automatically
- Step 04
Start using Cortex XSIAM
Open Cascade and ask: "Using Cortex XSIAM, help me...". 9 tools available
Cline · IDE configuration
Advanced setup
{
"mcpServers": {
"cortex-xsiam": {
"url": "https://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/mcp"
}
}
}- Step 01
Open Cline MCP Settings
Click the Connectors icon in the Cline sidebar panel
- Step 02
Add remote server
Click "Add Connector" and paste the configuration above
- Step 03
Enable the server
Toggle the server switch to ON
- Step 04
Start using Cortex XSIAM
Ask Cline: "Using Cortex XSIAM, help me...". 9 tools available
Claude Code · Terminal command
Advanced setup
claude mcp add cortex-xsiam --transport http "https://edge.vinkius.com/vk_preview_YwrSpVSwSvDK62ayYXdVmPKCeutuJGKGx2KNGGce/mcp"- Step 01
Install Claude Code
Run npm install -g @anthropic-ai/claude-code if not already installed
- Step 02
Add the Connector
Run the command above in your terminal
- Step 03
Verify the connection
Run claude mcp to list connected servers, or type /mcp inside a session
- Step 04
Start using Cortex XSIAM
Ask Claude: "Using Cortex XSIAM, show me...". 9 tools are ready
Where the request belongs
Work Cortex XSIAM can move forward.
This is for the SOC analyst who spends half their shift copy-pasting data between capabilities. It's for the security engineer tired of manual incident triage and the threat hunter who wants to query logs faster.
SOC Analyst
Triage alerts and gather incident details without leaving the chat.
Threat Hunter
Run XQL queries to find hidden patterns across the network.
Security Engineer
Trigger playbooks and manage endpoint isolation at scale.
Build the capability set
Add more capabilities.
Each Connector adds new actions and data without changing how you work.
Browse ConnectorsIBM watsonx
Connect IBM watsonx to any AI agent via MCP.
Lancerkit
Connect Lancerkit to any AI agent via MCP.
Prisma Access
Connect Prisma Access to any AI agent via MCP.
AgentOps (Agent Telemetry and Monitoring)
Monitor and observe your AI agents with AgentOps. track traces, spans, and project metrics directly from your agent.
IBM Quantum
Connect IBM Quantum to any AI agent via MCP.
Prisma Cloud
Connect Prisma Cloud to any AI agent via MCP.
Bring your own AI
Change the model, client or framework. Keep Cortex XSIAM connected.
-
Claude -
ChatGPT -
Gemini -
Cursor -
VS Code -
Windsurf -
ZCode -
Cline -
Zed -
Continue -
Kiro -
Roo Code -
Zencoder -
Goose -
Void -
Augment Code -
Amp -
Qodo -
Tabnine -
Pieces -
Sourcegraph Cody -
JetBrains -
Warp -
Amazon Q -
Antigravity -
BoltAI -
Raycast -
Jan -
LM Studio -
AnythingLLM -
Open WebUI -
Msty -
Cherry Studio -
LibreChat -
TypingMind -
Chorus -
5ire -
n8n -
LangChain -
LlamaIndex -
CrewAI -
Vercel AI SDK
Before you connect
Questions about Cortex XSIAM.
The practical details behind the request, access and result.
How does the Cortex XSIAM MCP help my security team?
It lets your AI agent interact directly with your security data. You can pull alerts, hunt for threats, and trigger actions like isolating hosts without switching tabs.
Can I use this Connector to automate my incident response?
Yes. You can have your agent trigger existing playbooks to handle routine tasks like resetting passwords or blocking IPs automatically.
Will this Connector help with threat hunting?
Definitely. Your agent can run XQL queries to search through logs and network data to find specific patterns or malicious activity.
Can the AI agent actually isolate a host?
Yes, it can. If you confirm a machine is compromised, the agent can trigger the command to cut that host off from the network immediately.
What happens if I need to see all my managed devices?
The agent can pull a full list of your endpoints. This helps you audit your coverage or find specific hosts that need remediation.
Is this Connector for real-time security monitoring?
It's perfect for it. You can ask the agent to monitor the SOC queue and summarize high-severity incidents as they come in.
One connection away
Give your agent a direct line to Cortex XSIAM.
Connect Cortex XSIAM once. Keep it beside 5,900+ managed Connectors when the next task needs more.
Explore every Connector No credit card required · Free tier available