Elastic Security Connector for AI agents.
10 live capabilities
Manage SIEM alerts and audit threat coverage from your favorite AI client.
Waiting for input…
Why people use Elastic Security
Elastic Security SIEM Alert Management
With this Connector, you just ask your agent to pull all signals for a specific user or hostname. It returns a clean table with enriched data like process trees and locations instantly, letting you stay in your flow instead of hunting through menus.
What Vinkius changes
You can manage your entire SIEM operation through a chat interface instead of clicking through Kibana.
Use it from Claude, ChatGPT, Cursor or another AI client you already have.
One account · 5,900+ Connectors
- Real-world use case 01
Rapid Alert Triage
An analyst sees a spike in alerts and asks the agent to search_signals for a specific user to see the process tree and IP geolocations instantly.
- Real-world use case 02
False Positive Suppression
A security engineer uses add_exception to whitelist a vulnerability scanner that is triggering constant alerts, cleaning up the dashboard.
- Real-world use case 03
Threat Coverage Audit
A CISO asks the agent to find_detection_rules for Ransomware to see if the current rules cover the latest threat tactics and MITRE mappings.
Complete set · 10capabilities
The complete Elastic Security capability set.
These are the exact actions your AI can choose when you ask it to work with Elastic Security.
01—04
4 capabilities in this set.
Part of 10 available through Elastic Security.
- 01 Capability
Find detection rules
Search for active rules using specific names, tags, or MITRE ATT&CK tactics. This is great for auditing your security coverage.
- 02 Capability
Add exception
Add a hostname to an existing exception list to stop alerts from specific devices. This helps you resolve false positives quickly.
- 03 Capability
Create rule
Build a new log detection rule to track specific malicious telemetry in your environment. It generates risk scores against your assets.
- 04 Capability
Delete rule
Permanently remove a custom detection rule from your SIEM engine. Use this to purge logic that is no longer needed.
05—07
3 capabilities in this set.
Part of 10 available through Elastic Security.
- 05 Capability
List exceptions
View all global exception lists that currently bypass specific security rules. This helps you see what is being ignored.
- 06 Capability
Get rule
View the exact query logic, severity, and run intervals for a specific rule. It also provides links to threat intel reports.
- 07 Capability
Get prepackaged rules status
Check if your official Elastic prepackaged rules need updates for new threat models. It identifies gaps in your Windows or Linux security.
08—10
3 capabilities in this set.
Part of 10 available through Elastic Security.
- 08 Capability
List detection rules
See every detection rule currently configured within your Elastic SIEM. This lets you map out your entire detection schema.
- 09 Capability
Search signals
Query raw security alerts to see enriched data like user profiles and IP geolocations. It consolidates multiple data points into one view.
- 10 Capability
Update rule
Enable or disable a specific detection rule to manage noise across your organization. Use this to tune triggers in real time.
Set up in minutes
One URL. Then ask Elastic Security to work.
Claude and ChatGPT only need the Connector URL. Copy it once, add it in settings, and use Elastic Security from the conversation.
Choose your client
Live previewAdvanced clients IDE · CLI
Claude · Web + desktop
Connector URL · ready to paste
Streamable HTTPhttps://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp - Step 01
Open Connectors
In Claude Web or Claude Desktop, open Settings and choose Connectors.
- Step 02
Add the URL
Choose Add custom connector, name it Elastic Security, and paste the URL above.
- Step 03
Turn it on in chat
Select +, open Connectors, and enable Elastic Security for the conversation.
ChatGPT · Web + desktop
Connector URL · ready to paste
Streamable HTTPhttps://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp - Step 01
Open MCP settings
On desktop, open Settings and MCP servers. On web, open your workspace app or connector settings.
- Step 02
Add the URL
Choose Add server with Streamable HTTP, or create a custom MCP app, then paste the Elastic Security URL.
- Step 03
Save and start
Save the connection and enable Elastic Security in your conversation. Desktop may ask you to restart once.
Cursor · IDE configuration
Advanced setup
{
"mcpServers": {
"elastic-security": {
"url": "https://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp"
}
}
}- Step 01
Open MCP Settings
Press Cmd+Shift+P (macOS) or Ctrl+Shift+P (Windows/Linux) → search "MCP Settings"
- Step 02
Add the server config
Paste the JSON configuration above into the mcp.json file that opens
- Step 03
Save the file
Cursor will automatically detect the new Connector
- Step 04
Start using Elastic Security
Open Agent mode in chat and ask: "Using Elastic Security, help me...". 10 tools available
VS Code Copilot · IDE configuration
Advanced setup
{
"mcpServers": {
"elastic-security": {
"url": "https://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp"
}
}
}- Step 01
Create MCP config
Create a .vscode/mcp.json file in your project root
- Step 02
Add the server config
Paste the JSON configuration above
- Step 03
Enable Agent mode
Open GitHub Copilot Chat and switch to Agent mode using the dropdown
- Step 04
Start using Elastic Security
Ask Copilot: "Using Elastic Security, help me...". 10 tools available
Windsurf · IDE configuration
Advanced setup
{
"mcpServers": {
"elastic-security": {
"url": "https://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp"
}
}
}- Step 01
Open MCP Settings
Go to Settings → MCP Configuration or press Cmd+Shift+P and search "MCP"
- Step 02
Add the server
Paste the JSON configuration above into mcp_config.json
- Step 03
Save and reload
Windsurf will detect the new server automatically
- Step 04
Start using Elastic Security
Open Cascade and ask: "Using Elastic Security, help me...". 10 tools available
Cline · IDE configuration
Advanced setup
{
"mcpServers": {
"elastic-security": {
"url": "https://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp"
}
}
}- Step 01
Open Cline MCP Settings
Click the Connectors icon in the Cline sidebar panel
- Step 02
Add remote server
Click "Add Connector" and paste the configuration above
- Step 03
Enable the server
Toggle the server switch to ON
- Step 04
Start using Elastic Security
Ask Cline: "Using Elastic Security, help me...". 10 tools available
Claude Code · Terminal command
Advanced setup
claude mcp add elastic-security --transport http "https://edge.vinkius.com/vk_preview_yoRwv3p0kyRWtXaW6iNtkYfU9l5Iu9BBOzCcOvtN/mcp"- Step 01
Install Claude Code
Run npm install -g @anthropic-ai/claude-code if not already installed
- Step 02
Add the Connector
Run the command above in your terminal
- Step 03
Verify the connection
Run claude mcp to list connected servers, or type /mcp inside a session
- Step 04
Start using Elastic Security
Ask Claude: "Using Elastic Security, show me...". 10 tools are ready
Where the request belongs
Work Elastic Security can move forward.
This is for the security professional who is tired of manual alert triage and wants to automate the repetitive parts of SOC auditing.
SOC Analyst
They use this to quickly pull enriched alert data and triage signals without losing time in the Kibana UI.
Security Engineer
They use this to create new detection logic and manage exception lists using natural language.
CISO
They use this to get a high-level view of threat coverage and audit the security posture during investigations.
DevOps Engineer
They use this to monitor SIEM health and ensure prepackaged rules are up to date.
Build the capability set
Add more capabilities.
Each Connector adds new actions and data without changing how you work.
Browse ConnectorsDatadog Cloud SIEM
Manage cloud security via Datadog. search security signals, triage alerts, and audit detection rules directly from any AI agent.
Wazuh (SIEM)
Manage your Wazuh SIEM infrastructure—monitor agents, inspect security events, and manage manager configurations directly from your AI agent.
Salt Security
Integrate Salt Security directly with your AI for comprehensive API threat vector discovery, posture management, and active remediation in real-time.
Trend Micro
Equip your AI agent with Vision One telemetry to investigate threats, audit endpoint activities, and manage security alerts natively.
Senar.io
Detect and respond to security threats with AI-powered SIEM that correlates events across your infrastructure in real time.
CrowdStrike Falcon
Detect threats, manage endpoints, investigate incidents, and query telemetry from CrowdStrike Falcon. the #1 endpoint detection and response platform.
Bring your own AI
Change the model, client or framework. Keep Elastic Security connected.
-
Claude -
ChatGPT -
Gemini -
Cursor -
VS Code -
Windsurf -
ZCode -
Cline -
Zed -
Continue -
Kiro -
Roo Code -
Zencoder -
Goose -
Void -
Augment Code -
Amp -
Qodo -
Tabnine -
Pieces -
Sourcegraph Cody -
JetBrains -
Warp -
Amazon Q -
Antigravity -
BoltAI -
Raycast -
Jan -
LM Studio -
AnythingLLM -
Open WebUI -
Msty -
Cherry Studio -
LibreChat -
TypingMind -
Chorus -
5ire -
n8n -
LangChain -
LlamaIndex -
CrewAI -
Vercel AI SDK
Before you connect
Questions about Elastic Security.
The practical details behind the request, access and result.
Can the Elastic Security MCP help me find specific security alerts?
Yes. You can ask your agent to search for signals based on users, hostnames, or specific timeframes. It will pull enriched data like IP geolocations and process trees directly into your chat.
How does the Elastic Security MCP handle false positives?
It allows you to manage exception lists. You can tell your agent to add specific hostnames to a whitelist so that known-good behavior stops triggering unnecessary alerts.
Can I use the Elastic Security MCP to audit my MITRE coverage?
Absolutely. You can search for rules based on specific MITRE ATT&CK tactics or tags to see exactly where your current detection logic stands.
Does the Elastic Security MCP support updating prepackaged rules?
It can check the status of official prepackaged rules. Your agent can identify if your environment is missing the latest threat models for Windows, Linux, or Cloud.
How do I manage detection rules with the Elastic Security MCP?
You can create new custom rules, update existing ones to tune noise, or delete old rules entirely using natural language commands through your AI client.
Can I see the logic behind a specific rule using the Elastic Security MCP?
Yes. You can ask your agent for the exact details of a rule, including its query logic, run intervals, and severity assignment.
Can my agent list all detection rules currently active in my SIEM?
Yes. Use the 'list_detection_rules' capability. It returns both custom rules and Elastic prepackaged ML algorithms, which is vital for mapping your MITRE ATT&CK coverage.
How do I whitelist a hostname to resolve a false positive via chat?
Use the 'add_exception' mutation. Provide the Exception List ID and the hostname string. The agent will update the container, implicitly ignoring telemetry matched on this host for any bound rule.
Can I search for security alerts (Signals) using KQL through the agent?
Absolutely. The 'search_signals' capability allows you to retrieve critical alert logs. You can provide an optional KQL query to filter for specific users, hostnames, or process trees within your security telemetry.
One connection away
Give your agent a direct line to Elastic Security.
Connect Elastic Security once. Keep it beside 5,900+ managed Connectors when the next task needs more.
Explore every Connector No credit card required · Free tier available