Skip to main content
Glama
MohitDabas

SigmaLineage MCP

by MohitDabas
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

Related Servers

Alternatives to SigmaLineage MCP

No user-submitted related servers found.

    Related Servers

    • CrowdSentinel MCP Server

      thomasxm
      A
      license
      Not graded
      quality
      A
      maintenance
      Enables natural language threat hunting and incident response by connecting LLMs to enterprise security data sources like Elasticsearch, EVTX logs, PCAP files, and Velociraptor.
      206
      GPL 3.0

    • Windows Forensics MCP Server

      x746b
      A
      license
      B
      quality
      A
      maintenance
      Enables AI-assisted Windows digital forensics analysis including parsing Windows Event Logs (EVTX), analyzing registry hives (SAM, SYSTEM, SOFTWARE), and remotely collecting artifacts via WinRM with built-in security queries and forensic reference data.
      43
      21
      MIT

    • WinLog-mcp

      XD3an
      A
      license
      Not graded
      quality
      D
      maintenance
      Provides programmatic access to ingest and query Windows event logs (especially Sysmon logs), enabling security monitoring, incident response, and log analysis automation.
      5
      MIT

    • EventWhisper

      Hexastrike
      A
      license
      Not graded
      quality
      D
      maintenance
      Enables fast, scriptable access to Windows .evtx event logs for incident response and digital forensics. Supports filtering events by time windows, Event IDs, and keywords with field projection to reduce output size.
      49
      GPL 3.0

    • mcp-hayabusa

      SBecraft
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables Windows event log forensics by wrapping Hayabusa, offering EVTX scanning, Sigma rule exploration, ATT&CK coverage analysis, and detection engineering resources.
      MIT

    • secops-agent-triage

      drummer475-94
      A
      license
      Not graded
      quality
      C
      maintenance
      Enables AI agents to perform security alert triage by ingesting raw logs, extracting IOCs, querying threat intelligence sources, and generating structured NIST/MITRE assessments with reasoning traces.
      MIT
    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    B3/5.0

    Scored across 3 tools

    Disambiguation5/5

    Each tool has a distinct purpose: one focuses on rare event baselines, another on Sigma hunts, and the third on Sigma hunts with lineage tracing. There is no overlap or ambiguity.

    Naming Consistency3/5

    The first tool uses a noun phrase pattern (rare_events_baseline), while the other two use a verb-noun pattern (run_sigma, run_sigma_lineage). This inconsistency in naming style may cause confusion for an agent.

    Tool Count4/5

    With 3 tools, the set is slightly small but well-scoped for the domain. Each tool serves a clear function without unnecessary bloat, fitting within the typical 3-15 range.

    Completeness4/5

    The tools cover the core workflows: baseline analysis, sigma hunts, and lineage tracing. There are minor gaps (e.g., no tool for managing rules or results), but the surface is complete for intended use.

    Maintenance

    ActivityStale
    ResponsivenessNo issues

    Resources