Skip to main content
Glama
JoaquinHernandez

soc-siem-mcp

soc-siem-mcp-

🛡️ SOC & Threat Hunting Unified SIEM MCP Gateway

A Model Context Protocol (MCP) server that empowers AI Assistants (Claude, ChatGPT, Gemini, and AI Aura) to perform SOC operations, investigate alerts, and hunt malicious actors across Azure Sentinel, Splunk, Wazuh, IBM QRadar, and Securonix.


🚀 Features

  • Cross-SIEM IOC Hunting: Fan-out queries across all SIEM engines simultaneously to detect lateral movement.

  • MITRE ATT&CK Behavioral Hunts: Pre-mapped hunts for techniques like PowerShell obfuscation (T1059.001) and LSASS dumping (T1003).

  • CTI & Threat Actor Attribution: Automatic threat scoring and APT group tagging via VirusTotal.

  • Dual Transport: Supports stdio (Claude Desktop) and SSE / HTTP (ChatGPT, Gemini, AI Aura).


Related MCP server: MCP-SOC Middleware

🛠️ Quickstart

1. Clone & Setup

git clone [https://github.com/](https://github.com/)<your-username>/soc-siem-mcp.git
cd soc-siem-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
cp .env.example .env****


Run with Docker
Bash
docker-compose up --build -d

ChatGPT / AI Aura / Gemini
Run the server in SSE mode (MCP_TRANSPORT=sse on port 8000).

Expose the port (or use Cloudflare Tunnel/ngrok).

Connect your assistant to: https://<your-domain>/sse (or import /openapi.json into Custom GPT Actions).


---

### 9. Git Commands to Push to GitHub

Run these commands in your project root directory:

```bash
# 1. Initialize git
git init -b main

# 2. Add all files
git add .

# 3. Create initial commit
git commit -m "feat: initial release of SOC Threat Hunting SIEM MCP Gateway"

# 4. Link to your GitHub repository
git remote add origin https://github.com/<your-username>/soc-siem-mcp.git

# 5. Push to GitHub
git push -u origin main
A
license - permissive license
-
quality - not tested
B
maintenance

Maintenance

Maintainers
Response time
Release cycle
Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

  • A
    license
    -
    quality
    D
    maintenance
    An AI-powered security operations platform that integrates with SIEM, EDR, and case management systems via MCP to automate incident response and investigation workflows. It provides specialized tools for alert triage, threat intelligence enrichment, and endpoint remediation across vendor-neutral APIs.
    46
    MIT
  • A
    license
    -
    quality
    C
    maintenance
    Enables AI agents to interact with Splunk SIEM and TheHive SOAR through a unified MCP interface, providing 12 tools for alert triage, case management, and security operations.
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    AI-powered MCP server that enables security analysts to query Wazuh SIEM/XDR for alert triage, threat hunting, compliance audits, and incident response through natural language prompts.
    28
    13
    MIT

View all related MCP servers

Related MCP Connectors

  • AI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT.

  • Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.

  • Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/JoaquinHernandez/soc-siem-mcp-'

If you have feedback or need assistance with the MCP directory API, please join our Discord server