security-detections-mcp 1.0.0

package/README.md

@@ -0,0 +1,188 @@
+# Security Detections MCP
+
+An MCP (Model Context Protocol) server that lets LLMs query a unified database of **Sigma** and **Splunk ESCU** security detection rules.
+
+[![Add to Cursor](https://img.shields.io/badge/Add%20to-Cursor-blue?style=for-the-badge&logo=cursor)](cursor://anysphere.cursor-deeplink/mcp/install?name=security-detections&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsInNlY3VyaXR5LWRldGVjdGlvbnMtbWNwIl0sImVudiI6eyJTSUdNQV9QQVRIUyI6Ii9wYXRoL3RvL3NpZ21hL3J1bGVzLC9wYXRoL3RvL3NpZ21hL3J1bGVzLXRocmVhdC1odW50aW5nIiwiU1BMVU5LX1BBVEhTIjoiL3BhdGgvdG8vc2VjdXJpdHlfY29udGVudC9kZXRlY3Rpb25zIn19)
+
+## Features
+
+- **Unified Search** - Query both Sigma and Splunk ESCU detections from a single interface
+- **Full-Text Search** - SQLite FTS5 powered search across names, descriptions, queries, and tags
+- **MITRE ATT&CK Mapping** - Filter detections by technique ID (e.g., T1059.001)
+- **Auto-Indexing** - Automatically indexes detections on startup from configured paths
+- **Logsource Filtering** - Filter Sigma rules by category, product, or service
+- **Severity Filtering** - Filter by criticality level
+
+## Quick Start
+
+### Option 1: npx (Recommended)
+
+No installation required - just configure and run:
+
+```bash
+npx -y security-detections-mcp
+```
+
+### Option 2: Clone and Build
+
+```bash
+git clone https://github.com/MHaggis/Security-Detections-MCP.git
+cd Security-Detections-MCP
+npm install
+npm run build
+```
+
+## Configuration
+
+### Cursor IDE
+
+Add to your MCP config (`~/.cursor/mcp.json` or `.cursor/mcp.json` in your project):
+
+```json
+{
+  "mcpServers": {
+    "security-detections": {
+      "command": "npx",
+      "args": ["-y", "security-detections-mcp"],
+      "env": {
+        "SIGMA_PATHS": "/path/to/sigma/rules,/path/to/sigma/rules-threat-hunting",
+        "SPLUNK_PATHS": "/path/to/security_content/detections"
+      }
+    }
+  }
+}
+```
+
+### Claude Desktop
+
+Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "security-detections": {
+      "command": "npx",
+      "args": ["-y", "security-detections-mcp"],
+      "env": {
+        "SIGMA_PATHS": "/Users/you/sigma/rules,/Users/you/sigma/rules-threat-hunting",
+        "SPLUNK_PATHS": "/Users/you/security_content/detections"
+      }
+    }
+  }
+}
+```
+
+### Environment Variables
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+| `SIGMA_PATHS` | Comma-separated paths to Sigma rule directories | `/path/to/sigma/rules,/path/to/sigma/rules-threat-hunting` |
+| `SPLUNK_PATHS` | Comma-separated paths to Splunk ESCU detection directories | `/path/to/security_content/detections` |
+
+## Getting Detection Content
+
+### Sigma Rules
+
+```bash
+git clone https://github.com/SigmaHQ/sigma.git
+# Use rules/ and rules-threat-hunting/ directories
+```
+
+### Splunk ESCU
+
+```bash
+git clone https://github.com/splunk/security_content.git
+# Use detections/ directory
+```
+
+## MCP Tools
+
+| Tool | Description |
+|------|-------------|
+| `search(query, limit)` | Full-text search across all detection fields |
+| `get_by_id(id)` | Get a single detection by its ID |
+| `list_all(limit, offset)` | Paginated list of all detections |
+| `list_by_source(source_type)` | Filter by `sigma` or `splunk_escu` |
+| `list_by_mitre(technique_id)` | Filter by MITRE ATT&CK technique ID |
+| `list_by_logsource(category, product, service)` | Filter Sigma rules by logsource |
+| `list_by_severity(level)` | Filter by severity (informational/low/medium/high/critical) |
+| `get_stats()` | Get index statistics |
+| `rebuild_index()` | Force re-index from configured paths |
+| `get_raw_yaml(id)` | Get the original YAML content |
+
+## Example Workflow
+
+1. **Ask the LLM**: "Find me PowerShell detections related to base64 encoding"
+
+2. **LLM calls**: `search(query="powershell base64", limit=5)`
+
+3. **LLM receives**: Top 5 detections with names, descriptions, and detection logic
+
+4. **LLM explores**: Uses `get_by_id` to get full details on interesting detections
+
+5. **LLM filters by MITRE**: `list_by_mitre(technique_id="T1059.001")` to find all PowerShell execution detections
+
+## Unified Schema
+
+Both Sigma and Splunk ESCU detections are normalized to a common schema:
+
+| Field | Description |
+|-------|-------------|
+| `id` | Unique identifier (UUID for Sigma, ID field for Splunk) |
+| `name` | Detection name/title |
+| `description` | What the detection looks for |
+| `query` | Detection logic (Sigma YAML or Splunk SPL) |
+| `source_type` | `sigma` or `splunk_escu` |
+| `mitre_ids` | Mapped MITRE ATT&CK technique IDs |
+| `logsource_category` | Sigma logsource category |
+| `logsource_product` | Sigma logsource product (windows, linux, etc.) |
+| `logsource_service` | Sigma logsource service |
+| `severity` | Detection severity level |
+| `status` | Rule status (stable, test, experimental, etc.) |
+| `author` | Rule author |
+| `date_created` | Creation date |
+| `date_modified` | Last modification date |
+| `references` | External references |
+| `falsepositives` | Known false positive scenarios |
+| `tags` | All tags (MITRE, analytic stories, etc.) |
+| `file_path` | Original file path |
+| `raw_yaml` | Original YAML content |
+
+## Database
+
+The index is stored at `~/.cache/security-detections-mcp/detections.sqlite`.
+
+- Auto-created on first run
+- Auto-indexed when paths are configured
+- Use `rebuild_index()` to refresh after updating detection repos
+
+## Supported Detection Formats
+
+### Sigma Rules
+
+Based on the [official Sigma specification](https://github.com/SigmaHQ/sigma-specification):
+- All required fields: `title`, `logsource`, `detection`
+- All optional fields: `id`, `status`, `description`, `author`, `date`, `modified`, `references`, `tags`, `level`, `falsepositives`, etc.
+
+### Splunk ESCU
+
+From [Splunk Security Content](https://github.com/splunk/security_content):
+- Required: `name`, `id`, `search`
+- Optional: `description`, `author`, `date`, `status`, `references`, `tags` (including `mitre_attack_id`, `analytic_story`)
+
+## Development
+
+```bash
+# Install dependencies
+npm install
+
+# Build
+npm run build
+
+# Run with paths
+SIGMA_PATHS="./detections/sigma/rules" SPLUNK_PATHS="./detections/splunk/detections" npm start
+```
+
+## License
+
+Apache 2.0

package/dist/db.d.ts

@@ -0,0 +1,17 @@
+import Database from 'better-sqlite3';
+import type { Detection, IndexStats } from './types.js';
+export declare function getDbPath(): string;
+export declare function initDb(): Database.Database;
+export declare function clearDb(): void;
+export declare function insertDetection(detection: Detection): void;
+export declare function searchDetections(query: string, limit?: number): Detection[];
+export declare function getDetectionById(id: string): Detection | null;
+export declare function listDetections(limit?: number, offset?: number): Detection[];
+export declare function listBySource(sourceType: 'sigma' | 'splunk_escu', limit?: number, offset?: number): Detection[];
+export declare function listByMitre(techniqueId: string, limit?: number, offset?: number): Detection[];
+export declare function listByLogsource(category?: string, product?: string, service?: string, limit?: number, offset?: number): Detection[];
+export declare function listBySeverity(level: string, limit?: number, offset?: number): Detection[];
+export declare function getStats(): IndexStats;
+export declare function getRawYaml(id: string): string | null;
+export declare function dbExists(): boolean;
+export declare function getDetectionCount(): number;

package/dist/db.js

@@ -0,0 +1,248 @@
+import Database from 'better-sqlite3';
+import { homedir } from 'os';
+import { join } from 'path';
+import { mkdirSync, existsSync } from 'fs';
+const CACHE_DIR = join(homedir(), '.cache', 'security-detections-mcp');
+const DB_PATH = join(CACHE_DIR, 'detections.sqlite');
+let db = null;
+export function getDbPath() {
+    return DB_PATH;
+}
+export function initDb() {
+    if (db)
+        return db;
+    // Ensure cache directory exists
+    if (!existsSync(CACHE_DIR)) {
+        mkdirSync(CACHE_DIR, { recursive: true });
+    }
+    db = new Database(DB_PATH);
+    // Create main detections table
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS detections (
+      id TEXT PRIMARY KEY,
+      name TEXT NOT NULL,
+      description TEXT,
+      query TEXT,
+      source_type TEXT NOT NULL,
+      mitre_ids TEXT,
+      logsource_category TEXT,
+      logsource_product TEXT,
+      logsource_service TEXT,
+      severity TEXT,
+      status TEXT,
+      author TEXT,
+      date_created TEXT,
+      date_modified TEXT,
+      refs TEXT,
+      falsepositives TEXT,
+      tags TEXT,
+      file_path TEXT,
+      raw_yaml TEXT
+    )
+  `);
+    // Create FTS5 virtual table for full-text search
+    db.exec(`
+    CREATE VIRTUAL TABLE IF NOT EXISTS detections_fts USING fts5(
+      id,
+      name,
+      description,
+      query,
+      mitre_ids,
+      tags,
+      content='detections',
+      content_rowid='rowid'
+    )
+  `);
+    // Create triggers to keep FTS in sync
+    db.exec(`
+    CREATE TRIGGER IF NOT EXISTS detections_ai AFTER INSERT ON detections BEGIN
+      INSERT INTO detections_fts(rowid, id, name, description, query, mitre_ids, tags)
+      VALUES (NEW.rowid, NEW.id, NEW.name, NEW.description, NEW.query, NEW.mitre_ids, NEW.tags);
+    END
+  `);
+    db.exec(`
+    CREATE TRIGGER IF NOT EXISTS detections_ad AFTER DELETE ON detections BEGIN
+      INSERT INTO detections_fts(detections_fts, rowid, id, name, description, query, mitre_ids, tags)
+      VALUES ('delete', OLD.rowid, OLD.id, OLD.name, OLD.description, OLD.query, OLD.mitre_ids, OLD.tags);
+    END
+  `);
+    db.exec(`
+    CREATE TRIGGER IF NOT EXISTS detections_au AFTER UPDATE ON detections BEGIN
+      INSERT INTO detections_fts(detections_fts, rowid, id, name, description, query, mitre_ids, tags)
+      VALUES ('delete', OLD.rowid, OLD.id, OLD.name, OLD.description, OLD.query, OLD.mitre_ids, OLD.tags);
+      INSERT INTO detections_fts(rowid, id, name, description, query, mitre_ids, tags)
+      VALUES (NEW.rowid, NEW.id, NEW.name, NEW.description, NEW.query, NEW.mitre_ids, NEW.tags);
+    END
+  `);
+    // Create indexes for common queries
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_source_type ON detections(source_type)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_severity ON detections(severity)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_logsource_product ON detections(logsource_product)`);
+    db.exec(`CREATE INDEX IF NOT EXISTS idx_logsource_category ON detections(logsource_category)`);
+    return db;
+}
+export function clearDb() {
+    const database = initDb();
+    database.exec('DELETE FROM detections');
+}
+export function insertDetection(detection) {
+    const database = initDb();
+    const stmt = database.prepare(`
+    INSERT OR REPLACE INTO detections 
+    (id, name, description, query, source_type, mitre_ids, logsource_category, 
+     logsource_product, logsource_service, severity, status, author, 
+     date_created, date_modified, refs, falsepositives, tags, file_path, raw_yaml)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `);
+    stmt.run(detection.id, detection.name, detection.description, detection.query, detection.source_type, JSON.stringify(detection.mitre_ids), detection.logsource_category, detection.logsource_product, detection.logsource_service, detection.severity, detection.status, detection.author, detection.date_created, detection.date_modified, JSON.stringify(detection.references), JSON.stringify(detection.falsepositives), JSON.stringify(detection.tags), detection.file_path, detection.raw_yaml);
+}
+function rowToDetection(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        description: row.description || '',
+        query: row.query || '',
+        source_type: row.source_type,
+        mitre_ids: JSON.parse(row.mitre_ids || '[]'),
+        logsource_category: row.logsource_category,
+        logsource_product: row.logsource_product,
+        logsource_service: row.logsource_service,
+        severity: row.severity,
+        status: row.status,
+        author: row.author,
+        date_created: row.date_created,
+        date_modified: row.date_modified,
+        references: JSON.parse(row.refs || '[]'),
+        falsepositives: JSON.parse(row.falsepositives || '[]'),
+        tags: JSON.parse(row.tags || '[]'),
+        file_path: row.file_path,
+        raw_yaml: row.raw_yaml,
+    };
+}
+export function searchDetections(query, limit = 50) {
+    const database = initDb();
+    // Use FTS5 for search
+    const stmt = database.prepare(`
+    SELECT d.* FROM detections d
+    JOIN detections_fts fts ON d.rowid = fts.rowid
+    WHERE detections_fts MATCH ?
+    ORDER BY rank
+    LIMIT ?
+  `);
+    const rows = stmt.all(query, limit);
+    return rows.map(rowToDetection);
+}
+export function getDetectionById(id) {
+    const database = initDb();
+    const stmt = database.prepare('SELECT * FROM detections WHERE id = ?');
+    const row = stmt.get(id);
+    return row ? rowToDetection(row) : null;
+}
+export function listDetections(limit = 100, offset = 0) {
+    const database = initDb();
+    const stmt = database.prepare('SELECT * FROM detections ORDER BY name LIMIT ? OFFSET ?');
+    const rows = stmt.all(limit, offset);
+    return rows.map(rowToDetection);
+}
+export function listBySource(sourceType, limit = 100, offset = 0) {
+    const database = initDb();
+    const stmt = database.prepare('SELECT * FROM detections WHERE source_type = ? ORDER BY name LIMIT ? OFFSET ?');
+    const rows = stmt.all(sourceType, limit, offset);
+    return rows.map(rowToDetection);
+}
+export function listByMitre(techniqueId, limit = 100, offset = 0) {
+    const database = initDb();
+    // Search in JSON array
+    const stmt = database.prepare(`
+    SELECT * FROM detections 
+    WHERE mitre_ids LIKE ? 
+    ORDER BY name 
+    LIMIT ? OFFSET ?
+  `);
+    const rows = stmt.all(`%"${techniqueId}"%`, limit, offset);
+    return rows.map(rowToDetection);
+}
+export function listByLogsource(category, product, service, limit = 100, offset = 0) {
+    const database = initDb();
+    let sql = 'SELECT * FROM detections WHERE 1=1';
+    const params = [];
+    if (category) {
+        sql += ' AND logsource_category = ?';
+        params.push(category);
+    }
+    if (product) {
+        sql += ' AND logsource_product = ?';
+        params.push(product);
+    }
+    if (service) {
+        sql += ' AND logsource_service = ?';
+        params.push(service);
+    }
+    sql += ' ORDER BY name LIMIT ? OFFSET ?';
+    params.push(limit, offset);
+    const stmt = database.prepare(sql);
+    const rows = stmt.all(...params);
+    return rows.map(rowToDetection);
+}
+export function listBySeverity(level, limit = 100, offset = 0) {
+    const database = initDb();
+    const stmt = database.prepare('SELECT * FROM detections WHERE severity = ? ORDER BY name LIMIT ? OFFSET ?');
+    const rows = stmt.all(level, limit, offset);
+    return rows.map(rowToDetection);
+}
+export function getStats() {
+    const database = initDb();
+    const total = database.prepare('SELECT COUNT(*) as count FROM detections').get().count;
+    const sigma = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'sigma'").get().count;
+    const splunk = database.prepare("SELECT COUNT(*) as count FROM detections WHERE source_type = 'splunk_escu'").get().count;
+    // Count by severity
+    const severityRows = database.prepare(`
+    SELECT severity, COUNT(*) as count FROM detections 
+    WHERE severity IS NOT NULL 
+    GROUP BY severity
+  `).all();
+    const by_severity = {};
+    for (const row of severityRows) {
+        by_severity[row.severity] = row.count;
+    }
+    // Count by logsource product
+    const productRows = database.prepare(`
+    SELECT logsource_product, COUNT(*) as count FROM detections 
+    WHERE logsource_product IS NOT NULL 
+    GROUP BY logsource_product
+    ORDER BY count DESC
+    LIMIT 20
+  `).all();
+    const by_logsource_product = {};
+    for (const row of productRows) {
+        by_logsource_product[row.logsource_product] = row.count;
+    }
+    // Count detections with MITRE mappings
+    const mitre_coverage = database.prepare(`
+    SELECT COUNT(*) as count FROM detections 
+    WHERE mitre_ids != '[]' AND mitre_ids IS NOT NULL
+  `).get().count;
+    return {
+        total,
+        sigma,
+        splunk_escu: splunk,
+        by_severity,
+        by_logsource_product,
+        mitre_coverage,
+    };
+}
+export function getRawYaml(id) {
+    const database = initDb();
+    const stmt = database.prepare('SELECT raw_yaml FROM detections WHERE id = ?');
+    const row = stmt.get(id);
+    return row?.raw_yaml || null;
+}
+export function dbExists() {
+    return existsSync(DB_PATH);
+}
+export function getDetectionCount() {
+    if (!dbExists())
+        return 0;
+    const database = initDb();
+    return database.prepare('SELECT COUNT(*) as count FROM detections').get().count;
+}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,402 @@
+#!/usr/bin/env node
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, ListToolsRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
+import { searchDetections, getDetectionById, listDetections, listBySource, listByMitre, listByLogsource, listBySeverity, getStats, getRawYaml, getDbPath, initDb, } from './db.js';
+import { indexDetections, needsIndexing } from './indexer.js';
+// Parse comma-separated paths from env var
+function parsePaths(envVar) {
+    if (!envVar)
+        return [];
+    return envVar.split(',').map(p => p.trim()).filter(p => p.length > 0);
+}
+// Get configured paths from environment
+const SIGMA_PATHS = parsePaths(process.env.SIGMA_PATHS);
+const SPLUNK_PATHS = parsePaths(process.env.SPLUNK_PATHS);
+// Auto-index on startup if paths are configured and DB is empty
+function autoIndex() {
+    if (SIGMA_PATHS.length === 0 && SPLUNK_PATHS.length === 0) {
+        return;
+    }
+    initDb();
+    if (needsIndexing()) {
+        console.error('[security-detections-mcp] Auto-indexing detections...');
+        const result = indexDetections(SIGMA_PATHS, SPLUNK_PATHS);
+        console.error(`[security-detections-mcp] Indexed ${result.total} detections (${result.sigma_indexed} Sigma, ${result.splunk_indexed} Splunk ESCU)`);
+    }
+}
+// Create MCP server
+const server = new Server({
+    name: 'security-detections-mcp',
+    version: '1.0.0',
+}, {
+    capabilities: {
+        tools: {},
+    },
+});
+// Define available tools
+server.setRequestHandler(ListToolsRequestSchema, async () => {
+    return {
+        tools: [
+            {
+                name: 'search',
+                description: 'Full-text search across all detection fields (name, description, query, MITRE IDs, tags)',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        query: {
+                            type: 'string',
+                            description: 'Search query (FTS5 syntax supported)',
+                        },
+                        limit: {
+                            type: 'number',
+                            description: 'Max results to return (default 50)',
+                        },
+                    },
+                    required: ['query'],
+                },
+            },
+            {
+                name: 'get_by_id',
+                description: 'Get a single detection by its ID',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        id: {
+                            type: 'string',
+                            description: 'Detection ID (UUID for Sigma, or Splunk detection ID)',
+                        },
+                    },
+                    required: ['id'],
+                },
+            },
+            {
+                name: 'list_all',
+                description: 'List all detections with pagination',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        limit: {
+                            type: 'number',
+                            description: 'Max results to return (default 100)',
+                        },
+                        offset: {
+                            type: 'number',
+                            description: 'Offset for pagination (default 0)',
+                        },
+                    },
+                },
+            },
+            {
+                name: 'list_by_source',
+                description: 'List detections filtered by source type',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        source_type: {
+                            type: 'string',
+                            enum: ['sigma', 'splunk_escu'],
+                            description: 'Source type to filter by',
+                        },
+                        limit: {
+                            type: 'number',
+                            description: 'Max results to return (default 100)',
+                        },
+                        offset: {
+                            type: 'number',
+                            description: 'Offset for pagination (default 0)',
+                        },
+                    },
+                    required: ['source_type'],
+                },
+            },
+            {
+                name: 'list_by_mitre',
+                description: 'List detections that map to a specific MITRE ATT&CK technique',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        technique_id: {
+                            type: 'string',
+                            description: 'MITRE ATT&CK technique ID (e.g., T1059.001)',
+                        },
+                        limit: {
+                            type: 'number',
+                            description: 'Max results to return (default 100)',
+                        },
+                        offset: {
+                            type: 'number',
+                            description: 'Offset for pagination (default 0)',
+                        },
+                    },
+                    required: ['technique_id'],
+                },
+            },
+            {
+                name: 'list_by_logsource',
+                description: 'List Sigma detections filtered by logsource (category, product, or service)',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        category: {
+                            type: 'string',
+                            description: 'Logsource category (e.g., process_creation, network_connection)',
+                        },
+                        product: {
+                            type: 'string',
+                            description: 'Logsource product (e.g., windows, linux, aws)',
+                        },
+                        service: {
+                            type: 'string',
+                            description: 'Logsource service (e.g., sysmon, security, powershell)',
+                        },
+                        limit: {
+                            type: 'number',
+                            description: 'Max results to return (default 100)',
+                        },
+                        offset: {
+                            type: 'number',
+                            description: 'Offset for pagination (default 0)',
+                        },
+                    },
+                },
+            },
+            {
+                name: 'list_by_severity',
+                description: 'List detections filtered by severity level',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        level: {
+                            type: 'string',
+                            enum: ['informational', 'low', 'medium', 'high', 'critical'],
+                            description: 'Severity level to filter by',
+                        },
+                        limit: {
+                            type: 'number',
+                            description: 'Max results to return (default 100)',
+                        },
+                        offset: {
+                            type: 'number',
+                            description: 'Offset for pagination (default 0)',
+                        },
+                    },
+                    required: ['level'],
+                },
+            },
+            {
+                name: 'get_stats',
+                description: 'Get statistics about the indexed detections',
+                inputSchema: {
+                    type: 'object',
+                    properties: {},
+                },
+            },
+            {
+                name: 'rebuild_index',
+                description: 'Force re-index all detections from configured paths',
+                inputSchema: {
+                    type: 'object',
+                    properties: {},
+                },
+            },
+            {
+                name: 'get_raw_yaml',
+                description: 'Get the original YAML content for a detection',
+                inputSchema: {
+                    type: 'object',
+                    properties: {
+                        id: {
+                            type: 'string',
+                            description: 'Detection ID',
+                        },
+                    },
+                    required: ['id'],
+                },
+            },
+        ],
+    };
+});
+// Handle tool calls
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name, arguments: args } = request.params;
+    try {
+        switch (name) {
+            case 'search': {
+                const query = args?.query;
+                const limit = args?.limit || 50;
+                if (!query) {
+                    return { content: [{ type: 'text', text: 'Error: query is required' }] };
+                }
+                const results = searchDetections(query, limit);
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify(results, null, 2),
+                        }],
+                };
+            }
+            case 'get_by_id': {
+                const id = args?.id;
+                if (!id) {
+                    return { content: [{ type: 'text', text: 'Error: id is required' }] };
+                }
+                const detection = getDetectionById(id);
+                if (!detection) {
+                    return { content: [{ type: 'text', text: `Detection not found: ${id}` }] };
+                }
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify(detection, null, 2),
+                        }],
+                };
+            }
+            case 'list_all': {
+                const limit = args?.limit || 100;
+                const offset = args?.offset || 0;
+                const results = listDetections(limit, offset);
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify(results, null, 2),
+                        }],
+                };
+            }
+            case 'list_by_source': {
+                const sourceType = args?.source_type;
+                const limit = args?.limit || 100;
+                const offset = args?.offset || 0;
+                if (!sourceType) {
+                    return { content: [{ type: 'text', text: 'Error: source_type is required' }] };
+                }
+                const results = listBySource(sourceType, limit, offset);
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify(results, null, 2),
+                        }],
+                };
+            }
+            case 'list_by_mitre': {
+                const techniqueId = args?.technique_id;
+                const limit = args?.limit || 100;
+                const offset = args?.offset || 0;
+                if (!techniqueId) {
+                    return { content: [{ type: 'text', text: 'Error: technique_id is required' }] };
+                }
+                const results = listByMitre(techniqueId, limit, offset);
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify(results, null, 2),
+                        }],
+                };
+            }
+            case 'list_by_logsource': {
+                const category = args?.category;
+                const product = args?.product;
+                const service = args?.service;
+                const limit = args?.limit || 100;
+                const offset = args?.offset || 0;
+                const results = listByLogsource(category, product, service, limit, offset);
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify(results, null, 2),
+                        }],
+                };
+            }
+            case 'list_by_severity': {
+                const level = args?.level;
+                const limit = args?.limit || 100;
+                const offset = args?.offset || 0;
+                if (!level) {
+                    return { content: [{ type: 'text', text: 'Error: level is required' }] };
+                }
+                const results = listBySeverity(level, limit, offset);
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify(results, null, 2),
+                        }],
+                };
+            }
+            case 'get_stats': {
+                const stats = getStats();
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify(stats, null, 2),
+                        }],
+                };
+            }
+            case 'rebuild_index': {
+                if (SIGMA_PATHS.length === 0 && SPLUNK_PATHS.length === 0) {
+                    return {
+                        content: [{
+                                type: 'text',
+                                text: 'Error: No paths configured. Set SIGMA_PATHS and/or SPLUNK_PATHS environment variables.',
+                            }],
+                    };
+                }
+                const result = indexDetections(SIGMA_PATHS, SPLUNK_PATHS);
+                return {
+                    content: [{
+                            type: 'text',
+                            text: JSON.stringify({
+                                message: 'Index rebuilt successfully',
+                                ...result,
+                                db_path: getDbPath(),
+                            }, null, 2),
+                        }],
+                };
+            }
+            case 'get_raw_yaml': {
+                const id = args?.id;
+                if (!id) {
+                    return { content: [{ type: 'text', text: 'Error: id is required' }] };
+                }
+                const yaml = getRawYaml(id);
+                if (!yaml) {
+                    return { content: [{ type: 'text', text: `Detection not found: ${id}` }] };
+                }
+                return {
+                    content: [{
+                            type: 'text',
+                            text: yaml,
+                        }],
+                };
+            }
+            default:
+                return {
+                    content: [{
+                            type: 'text',
+                            text: `Unknown tool: ${name}`,
+                        }],
+                };
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            content: [{
+                    type: 'text',
+                    text: `Error: ${message}`,
+                }],
+        };
+    }
+});
+// Main entry point
+async function main() {
+    // Auto-index on startup
+    autoIndex();
+    // Start MCP server
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error('[security-detections-mcp] Server started');
+}
+main().catch((error) => {
+    console.error('[security-detections-mcp] Fatal error:', error);
+    process.exit(1);
+});

package/dist/indexer.d.ts

@@ -0,0 +1,9 @@
+export interface IndexResult {
+    sigma_indexed: number;
+    sigma_failed: number;
+    splunk_indexed: number;
+    splunk_failed: number;
+    total: number;
+}
+export declare function indexDetections(sigmaPaths: string[], splunkPaths: string[]): IndexResult;
+export declare function needsIndexing(): boolean;

package/dist/indexer.js

@@ -0,0 +1,80 @@
+import { readdirSync, statSync } from 'fs';
+import { join, extname } from 'path';
+import { parseSigmaFile } from './parsers/sigma.js';
+import { parseSplunkFile } from './parsers/splunk.js';
+import { clearDb, insertDetection, getDetectionCount } from './db.js';
+// Recursively find all YAML files in a directory
+function findYamlFiles(dir) {
+    const files = [];
+    try {
+        const entries = readdirSync(dir);
+        for (const entry of entries) {
+            const fullPath = join(dir, entry);
+            try {
+                const stat = statSync(fullPath);
+                if (stat.isDirectory()) {
+                    files.push(...findYamlFiles(fullPath));
+                }
+                else if (stat.isFile()) {
+                    const ext = extname(entry).toLowerCase();
+                    if (ext === '.yml' || ext === '.yaml') {
+                        files.push(fullPath);
+                    }
+                }
+            }
+            catch {
+                // Skip files we can't stat
+            }
+        }
+    }
+    catch {
+        // Skip directories we can't read
+    }
+    return files;
+}
+export function indexDetections(sigmaPaths, splunkPaths) {
+    // Clear existing data
+    clearDb();
+    let sigma_indexed = 0;
+    let sigma_failed = 0;
+    let splunk_indexed = 0;
+    let splunk_failed = 0;
+    // Index Sigma rules
+    for (const basePath of sigmaPaths) {
+        const files = findYamlFiles(basePath);
+        for (const file of files) {
+            const detection = parseSigmaFile(file);
+            if (detection) {
+                insertDetection(detection);
+                sigma_indexed++;
+            }
+            else {
+                sigma_failed++;
+            }
+        }
+    }
+    // Index Splunk ESCU detections
+    for (const basePath of splunkPaths) {
+        const files = findYamlFiles(basePath);
+        for (const file of files) {
+            const detection = parseSplunkFile(file);
+            if (detection) {
+                insertDetection(detection);
+                splunk_indexed++;
+            }
+            else {
+                splunk_failed++;
+            }
+        }
+    }
+    return {
+        sigma_indexed,
+        sigma_failed,
+        splunk_indexed,
+        splunk_failed,
+        total: sigma_indexed + splunk_indexed,
+    };
+}
+export function needsIndexing() {
+    return getDetectionCount() === 0;
+}

package/dist/parsers/sigma.d.ts

@@ -0,0 +1,2 @@
+import type { Detection } from '../types.js';
+export declare function parseSigmaFile(filePath: string): Detection | null;

package/dist/parsers/sigma.js

@@ -0,0 +1,88 @@
+import { readFileSync } from 'fs';
+import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
+import { createHash } from 'crypto';
+// Extract MITRE ATT&CK IDs from Sigma tags
+// Tags like: attack.t1059.001, attack.execution, attack.s0154, attack.g0032
+function extractMitreIds(tags) {
+    if (!tags)
+        return [];
+    const mitreIds = [];
+    for (const tag of tags) {
+        const lower = tag.toLowerCase();
+        // Match technique IDs: attack.t1234 or attack.t1234.001
+        const techMatch = lower.match(/^attack\.t(\d{4}(?:\.\d{3})?)$/);
+        if (techMatch) {
+            mitreIds.push(`T${techMatch[1].toUpperCase()}`);
+            continue;
+        }
+        // Match software IDs: attack.s1234
+        const softMatch = lower.match(/^attack\.s(\d{4})$/);
+        if (softMatch) {
+            mitreIds.push(`S${softMatch[1]}`);
+            continue;
+        }
+        // Match group IDs: attack.g1234
+        const groupMatch = lower.match(/^attack\.g(\d{4})$/);
+        if (groupMatch) {
+            mitreIds.push(`G${groupMatch[1]}`);
+        }
+    }
+    return mitreIds;
+}
+// Generate a stable ID from file path and title if no UUID present
+function generateId(filePath, title) {
+    const hash = createHash('sha256')
+        .update(`${filePath}:${title}`)
+        .digest('hex')
+        .substring(0, 32);
+    return `sigma-${hash}`;
+}
+// Normalize falsepositives field (can be string or array)
+function normalizeFalsePositives(fp) {
+    if (!fp)
+        return [];
+    if (typeof fp === 'string')
+        return [fp];
+    return fp;
+}
+export function parseSigmaFile(filePath) {
+    try {
+        const content = readFileSync(filePath, 'utf-8');
+        const rule = parseYaml(content);
+        // title is required
+        if (!rule.title) {
+            return null;
+        }
+        // logsource and detection are required
+        if (!rule.logsource || !rule.detection) {
+            return null;
+        }
+        const id = rule.id || generateId(filePath, rule.title);
+        const detection = {
+            id,
+            name: rule.title,
+            description: rule.description || '',
+            query: stringifyYaml(rule.detection),
+            source_type: 'sigma',
+            mitre_ids: extractMitreIds(rule.tags),
+            logsource_category: rule.logsource.category || null,
+            logsource_product: rule.logsource.product || null,
+            logsource_service: rule.logsource.service || null,
+            severity: rule.level || null,
+            status: rule.status || null,
+            author: rule.author || null,
+            date_created: rule.date || null,
+            date_modified: rule.modified || null,
+            references: rule.references || [],
+            falsepositives: normalizeFalsePositives(rule.falsepositives),
+            tags: rule.tags || [],
+            file_path: filePath,
+            raw_yaml: content,
+        };
+        return detection;
+    }
+    catch (err) {
+        // Skip files that can't be parsed
+        return null;
+    }
+}

package/dist/parsers/splunk.d.ts

@@ -0,0 +1,2 @@
+import type { Detection } from '../types.js';
+export declare function parseSplunkFile(filePath: string): Detection | null;

package/dist/parsers/splunk.js

@@ -0,0 +1,42 @@
+import { readFileSync } from 'fs';
+import { parse as parseYaml } from 'yaml';
+export function parseSplunkFile(filePath) {
+    try {
+        const content = readFileSync(filePath, 'utf-8');
+        const rule = parseYaml(content);
+        // name and id are required
+        if (!rule.name || !rule.id) {
+            return null;
+        }
+        // search is required
+        if (!rule.search) {
+            return null;
+        }
+        const detection = {
+            id: rule.id,
+            name: rule.name,
+            description: rule.description || '',
+            query: rule.search,
+            source_type: 'splunk_escu',
+            mitre_ids: rule.tags?.mitre_attack_id || [],
+            logsource_category: null,
+            logsource_product: null,
+            logsource_service: null,
+            severity: null, // Splunk ESCU doesn't have severity in same way
+            status: rule.status || null,
+            author: rule.author || null,
+            date_created: rule.date || null,
+            date_modified: null,
+            references: rule.references || [],
+            falsepositives: rule.known_false_positives ? [rule.known_false_positives] : [],
+            tags: rule.tags?.analytic_story || [],
+            file_path: filePath,
+            raw_yaml: content,
+        };
+        return detection;
+    }
+    catch (err) {
+        // Skip files that can't be parsed
+        return null;
+    }
+}

package/dist/types.d.ts

@@ -0,0 +1,81 @@
+export interface Detection {
+    id: string;
+    name: string;
+    description: string;
+    query: string;
+    source_type: 'sigma' | 'splunk_escu';
+    mitre_ids: string[];
+    logsource_category: string | null;
+    logsource_product: string | null;
+    logsource_service: string | null;
+    severity: string | null;
+    status: string | null;
+    author: string | null;
+    date_created: string | null;
+    date_modified: string | null;
+    references: string[];
+    falsepositives: string[];
+    tags: string[];
+    file_path: string;
+    raw_yaml: string;
+}
+export interface SigmaRule {
+    title: string;
+    id?: string;
+    name?: string;
+    status?: 'stable' | 'test' | 'experimental' | 'deprecated' | 'unsupported';
+    description?: string;
+    license?: string;
+    author?: string;
+    references?: string[];
+    date?: string;
+    modified?: string;
+    logsource: {
+        category?: string;
+        product?: string;
+        service?: string;
+        definition?: string;
+    };
+    detection: Record<string, unknown>;
+    fields?: string[];
+    falsepositives?: string | string[];
+    level?: 'informational' | 'low' | 'medium' | 'high' | 'critical';
+    tags?: string[];
+    related?: Array<{
+        id: string;
+        type: string;
+    }>;
+    scope?: string[];
+    taxonomy?: string;
+}
+export interface SplunkDetection {
+    name: string;
+    id: string;
+    version?: number;
+    date?: string;
+    author?: string;
+    status?: string;
+    type?: string;
+    description?: string;
+    data_source?: string[];
+    search: string;
+    how_to_implement?: string;
+    known_false_positives?: string;
+    references?: string[];
+    tags?: {
+        analytic_story?: string[];
+        asset_type?: string;
+        mitre_attack_id?: string[];
+        product?: string[];
+        security_domain?: string;
+        [key: string]: unknown;
+    };
+}
+export interface IndexStats {
+    total: number;
+    sigma: number;
+    splunk_escu: number;
+    by_severity: Record<string, number>;
+    by_logsource_product: Record<string, number>;
+    mitre_coverage: number;
+}

package/dist/types.js

@@ -0,0 +1,2 @@
+// Unified detection schema - normalized from both Sigma and Splunk ESCU
+export {};

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "security-detections-mcp",
+  "version": "1.0.0",
+  "description": "MCP server for querying Sigma and Splunk ESCU security detection rules",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "security-detections-mcp": "dist/index.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MHaggis/Security-Detections-MCP.git"
+  },
+  "homepage": "https://github.com/MHaggis/Security-Detections-MCP#readme",
+  "bugs": {
+    "url": "https://github.com/MHaggis/Security-Detections-MCP/issues"
+  },
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "dev": "tsc --watch",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "mcp",
+    "security",
+    "detections",
+    "sigma",
+    "splunk",
+    "escu",
+    "siem",
+    "mitre",
+    "attack"
+  ],
+  "author": "Michael Haag",
+  "license": "Apache-2.0",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0",
+    "better-sqlite3": "^11.0.0",
+    "yaml": "^2.4.0"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.11",
+    "@types/node": "^20.0.0",
+    "typescript": "^5.4.0"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "files": [
+    "dist"
+  ]
+}