Enables automated creation of incident tickets in Jira for security events, with automatic priority and SLA calculation.
Enables pushing alert notifications to PagerDuty for incident response, with severity-based routing and on-call escalation.
Allows sending alert notifications to Slack channels, with severity-based routing for real-time security incident communication.
Provides comprehensive SOC investigation tools including IP pivoting, lateral movement detection, data exfiltration analysis, attack timeline reconstruction, and threat intelligence enrichment by querying Splunk indexes and security data.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Splunk MCP for SOC Operations pivot by IP 192.168.1.100"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An AI-native MCP (Model Context Protocol) server for SOC operations with Splunk, featuring automated investigation tools, label harvesting, and DeepTempo integration capabilities.
This project extends the capabilities of livehybrid/splunk-mcp with SOC-specific enrichment tools and security controls designed for AI-driven security investigations via Claude Desktop and other MCP clients.
Traditional SOC Workflows - IP pivoting, lateral movement detection, data exfiltration analysis
AI-Native Investigation - Cross-platform correlation, attack timeline reconstruction
Label Harvesting - Automatic discovery and mapping of Splunk field labels
Production Security - Input validation, audit logging, output sanitization
Multi-Mode Operation - SSE, STDIO, and API modes for flexible deployment
Related MCP server: FastMCP ThreatIntel
Python 3.10 or higher
Splunk Enterprise or Cloud instance
pip (included with Python)
Clone the repository:
git clone https://github.com/mando222/splunk-mcp-soc.git
cd splunk-mcp-socInstall dependencies:
Using pip (recommended):
pip install -r requirements.txtOr with UV:
uv syncOr with Poetry:
poetry installConfigure environment variables:
Create a .env file:
SPLUNK_HOST=localhost
SPLUNK_PORT=8089
SPLUNK_USERNAME=admin
SPLUNK_PASSWORD=your-password
SPLUNK_SCHEME=https
VERIFY_SSL=falseTest the connection:
python test_connection.pyRun the MCP server:
# STDIO mode (for Claude Desktop)
python splunk_mcp.py stdio
# SSE mode (default)
python splunk_mcp.py
# API mode
python splunk_mcp.py apihealth_check - Verify Splunk connectivity and available apps
ping - Check MCP server status
current_user - Get authenticated user information
list_users - List all Splunk users and roles
list_indexes - List all accessible indexes
get_index_info - Get detailed information about a specific index
indexes_and_sourcetypes - Comprehensive index and sourcetype mapping
search_splunk - Execute Splunk search queries with time ranges
list_saved_searches - View saved searches
list_kvstore_collections - List all KV store collections
create_kvstore_collection - Create new collections
delete_kvstore_collection - Remove collections
pivot_by_ip - Investigate all activity from a specific IP address
find_lateral_movement - Detect lateral movement patterns
calculate_data_exfiltration - Analyze and quantify data exfiltration
build_attack_timeline - Construct chronological attack timelines
correlate_with_deeptempo_finding - Cross-reference with DeepTempo findings
enrich_ip_with_threat_intel - Enrich IPs with reputation data from multiple sources
Queries AbuseIPDB, AlienVault OTX, and internal Splunk threat lists
Provides reputation score, threat types, and confidence levels
check_ioc_reputation - Quick reputation check for any IOC (IP, domain, hash, URL)
Auto-detects IOC type and provides actionable verdict
add_to_threat_list - Add confirmed IOCs to Splunk threat intelligence
Supports expiration and automatic cleanup
get_mitre_attack_context - Get detailed MITRE ATT&CK technique information
Maps findings to tactics, techniques, and procedures
Includes detection methods and mitigations
block_ip_address - Block malicious IPs at firewall/proxy level
Temporary or permanent blocking
Auto-unblock capability with configurable duration
isolate_host - Quarantine compromised hosts from network
Full, partial, or monitoring-only isolation levels
Integrates with NAC and endpoint security tools
create_incident_ticket - Auto-create tickets in ITSM platforms
ServiceNow, Jira, or native Splunk incident tracking
Automatic priority and SLA calculation
send_alert_notification - Push alerts to communication channels
Slack, Microsoft Teams, PagerDuty, email, SMS
Severity-based routing
detect_anomalies - Statistical anomaly detection on time-series data
Z-score based detection with configurable sensitivity
Identifies spikes, dips, and unusual patterns
identify_rare_events - Find statistically rare occurrences
Detects new processes, domains, or behaviors
Useful for zero-day and APT detection
baseline_normal_behavior - Establish behavioral profiles
Learn normal patterns for users, hosts, or services
Enables deviation-based threat detection
harvest_labels - Discover field labels and schemas from Splunk indexes
Configurable scope (all indexes, specific indexes, or CIM fields only)
Returns field names, types, sample values, and metadata
Supports filtering by index and time range
get_field_summary - Get detailed information about a specific field
Deep dive into field values, distribution, and relationships
Useful for understanding individual field usage
export_labels_to_deeptempo - Export labels in DeepTempo-compatible format
Generic JSON structure that can be adapted to DeepTempo's needs
Optional file export for integration workflows
Query: "Show me all activity from IP 10.1.42.42"
Results:
- 65 total events discovered
- 47 unique destinations contacted
- 10+ lateral movement attempts detected
- 1.2 GB data exfiltration identifiedQuery: "Build attack timeline for 10.1.42.42 and correlate with DeepTempo"
Results:
- 32-day attack timeline reconstructed
- Initial compromise → lateral movement → exfiltration
- 12 similar incidents identified
- Complete MITRE ATT&CK mappingQuery: "Hunt for similar C2 beaconing patterns across all hosts"
Results:
- 3 additional compromised hosts found
- Common service account identified (jenkins_service)
- Botnet infrastructure mappedGenerate and ingest test security data:
# Generate test data
python generate_test_data.py
# Ingest into Splunk
python ingest_test_data.py your-passwordThis creates an mcp_demo index with 115 security events:
50 C2 beaconing events
40 authentication/lateral movement events
20 DNS tunneling events
5 data exfiltration events
Run the test suite:
pytest tests/SSE Mode (default):
docker compose up -d mcpAPI Mode:
docker compose run --rm mcp python splunk_mcp.py apiSTDIO Mode:
docker compose run -i --rm mcp python splunk_mcp.py stdio./run_tests.sh --dockerVariable | Description | Default |
| Splunk server hostname | localhost |
| Splunk management port | 8089 |
| Authentication username | admin |
| Authentication password | - |
| Optional: Use token instead of user/pass | - |
| Connection scheme (http/https) | https |
| Enable SSL certificate verification | true |
| Logging level | INFO |
| Server mode (sse/api/stdio) | sse |
Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"splunk-soc": {
"command": "python",
"args": [
"/path/to/splunk-mcp-soc/splunk_mcp.py",
"stdio"
],
"env": {
"SPLUNK_HOST": "localhost",
"SPLUNK_PORT": "8089",
"SPLUNK_USERNAME": "admin",
"SPLUNK_PASSWORD": "your-password"
}
}
}
}Document | Purpose |
Detailed setup guide | |
Complete tool specifications | |
Investigation workflow examples | |
Development guidelines | |
Testing procedures |
Claude Desktop / MCP Client
│
├── Splunk MCP Server (this project)
│ ├── SOC Investigation Tools
│ ├── Label Harvesting
│ └── Splunk SDK Integration
│
└── DeepTempo MCP Server (separate)
├── Embedding Similarity Search
├── MITRE ATT&CK Mapping
└── LogLM Analysis✅ SSL/TLS support with configurable verification
✅ Token-based and credential-based authentication
✅ Environment variable configuration
✅ Input validation on all tools
✅ Audit logging support
Never commit .env files
Use VERIFY_SSL=true in production
Rotate credentials regularly
Monitor audit logs
Use least-privilege Splunk accounts
Contributions are welcome! Please see CONTRIBUTING.md for guidelines.
This project is built upon livehybrid/splunk-mcp v0.3.0 and extends it with:
SOC-specific investigation tools
Label harvesting capabilities
DeepTempo integration support
Enhanced security controls
FastMCP - MCP server framework
Splunk SDK for Python - Splunk API client
python-decouple - Configuration management
Apache License 2.0 - See LICENSE for details.
# Test Splunk connectivity
python test_connection.py
# Check logs
tail -f splunk_mcp.log# Ingest test data
python ingest_test_data.py your-password
# Verify in Splunk UI
index=mcp_demo | stats count by event_typeVerify .env file exists with correct values
Check Python version (3.10+ required)
Ensure Splunk is accessible
Review error logs
For issues and questions:
Check documentation
Review error logs
Open an issue on GitHub
Built with FastMCP for AI-native security operations 🚀
Add an IOC to Splunk's threat intelligence list.
Creates or updates a threat intelligence entry in Splunk that can be used for automated detection and correlation.
Args: ioc_value: The IOC to add (IP, domain, hash, etc.) ioc_type: Type of IOC ("ip", "domain", "hash", "url") threat_type: Classification ("malicious", "suspicious", "watchlist") description: Human-readable description of the threat expiration_days: Days until this IOC expires (0 = never)
Returns: Dictionary containing: - success: Boolean indicating if IOC was added - ioc_value: The IOC that was added - collection_name: KV store collection name - expires_at: Expiration timestamp
Inputs: ioc_type (required), ioc_value (required), description, threat_type, +1 more. Returns: result
Learn and establish normal behavior baseline for a user, host, or service.
Creates a behavioral profile that can be used to detect deviations indicating compromise or insider threats.
Args: entity: Entity to profile (hostname, username, service name) entity_type: Type of entity ("host", "user", "service") timeframe: Time period to establish baseline metrics: List of metrics to baseline (default: common security metrics)
Returns: Dictionary containing behavioral baseline profile
Inputs: entity (required), metrics, timeframe, entity_type. Returns: result
Block an IP address by adding it to Splunk's firewall blocklist.
Creates a block entry that can be consumed by firewalls, proxies, or other security controls integrated with Splunk. The block can be temporary or permanent.
Args: ip_address: IP address to block duration_hours: How long to block (0 = permanent) reason: Reason for blocking (for audit trail) auto_unblock: Whether to automatically remove block after duration
Returns: Dictionary containing: - success: Boolean indicating if block was applied - ip_address: The blocked IP - blocked_until: Expiration timestamp - block_id: Unique identifier for this block
Inputs: ip_address (required), reason, auto_unblock, duration_hours. Returns: result
Build comprehensive attack timeline from multiple indicators.
Reconstructs a multi-stage attack by correlating events across different indicators (IPs, users, domains) to show the complete attack narrative.
Args: indicators: List of indicators, e.g. [{"type": "ip", "value": "10.1.42.42"}, {"type": "user", "value": "admin"}] timeframe: Time window to search (default: "-30d") correlation_window: Time window in seconds to correlate events (default: 7200 = 2 hours)
Returns: Dictionary containing: - summary: Attack overview with duration and stages - timeline: Chronological events with MITRE ATT&CK mapping - attack_chain: Events grouped by attack stage - recommendations: Remediation suggestions
Inputs: indicators (required), timeframe, correlation_window. Returns: result
Calculate data transfer volumes and detect potential exfiltration.
Analyzes outbound data transfers to identify large or suspicious uploads that may indicate data exfiltration, a common final stage in targeted attacks.
Args: source_ip: Source IP to analyze dest_ip: Optional specific destination IP (analyzes all destinations if not provided) timeframe: Time window to analyze (default: "-24h") threshold_mb: Threshold in MB to flag as suspicious (default: 100)
Returns: Dictionary containing: - summary: Total bytes/MB transferred with thresholds - top_destinations: Ranked list of destinations by upload volume - timeline: Chronological transfer events - risk_indicators: Flags for suspicious patterns
Inputs: source_ip (required), dest_ip, timeframe, threshold_mb. Returns: result
Check the reputation of an Indicator of Compromise (IOC).
Supports IPs, domains, file hashes, and URLs. Provides a quick reputation check with actionable intelligence.
Args: ioc_value: The IOC to check (IP, domain, hash, or URL) ioc_type: Type of IOC ("ip", "domain", "hash", "url", or "auto" to detect)
Returns: Dictionary containing: - ioc_value: The IOC that was checked - ioc_type: Detected or specified type - verdict: "malicious", "suspicious", "unknown", or "benign" - confidence: 0.0-1.0 confidence score - threat_categories: List of threat types - recommendations: Suggested actions
Inputs: ioc_value (required), ioc_type. Returns: result
Correlate DeepTempo finding with Splunk evidence for cross-platform analysis.
This is the key tool for AI-native investigation - it bridges DeepTempo's AI-detected anomalies with Splunk's comprehensive log data to provide complete attack context.
Args: finding_id: DeepTempo finding ID deeptempo_data: Finding data from DeepTempo MCP server containing: - src_ip: Source IP address - dest_ip: Destination IP address - timestamp: Finding timestamp - confidence: Detection confidence score - mitre_techniques: List of MITRE ATT&CK techniques timeframe_padding: Time padding around finding (default: "1h")
Returns: Dictionary containing: - finding_id: DeepTempo finding ID - deeptempo_confidence: Original confidence score - splunk_evidence: Related events from Splunk - enriched_context: Historical and related activity - similar_incidents: Other related findings - recommended_actions: Analyst recommendations
Inputs: finding_id (required), deeptempo_data (required), timeframe_padding. Returns: result
Create an incident ticket in the ticketing system.
Auto-creates a ticket for tracking security incidents. Integrates with ITSM platforms like ServiceNow, Jira, or native Splunk incident management.
Args: title: Brief title of the incident description: Detailed description with evidence severity: "critical", "high", "medium", or "low" assignee: Username to assign ticket to (optional) tags: List of tags for categorization
Returns: Dictionary containing ticket details and tracking number
Inputs: title (required), description (required), tags, assignee, +1 more. Returns: result
Get information about the currently authenticated user.
This endpoint retrieves:
Basic user information (username, real name, email)
Assigned roles
Default app settings
User type
Returns: Dict[str, Any]: Dictionary containing user information
Inputs: no named parameters. Returns: result
Detect statistical anomalies in time-series data.
Uses statistical methods to identify unusual patterns, spikes, or outliers in security data that may indicate threats.
Args: index: Splunk index to analyze field: Field to analyze for anomalies (e.g., "bytes_out", "auth_failures") timeframe: Time range for analysis sensitivity: "low", "medium", or "high" (affects threshold) method: Detection method ("statistical", "ml", or "baseline")
Returns: Dictionary containing: - anomalies: List of detected anomalous periods - baseline: Normal behavior metrics - confidence: Detection confidence score - recommendations: Suggested actions
Inputs: field (required), index (required), method, timeframe, +1 more. Returns: result
Enrich an IP address with threat intelligence from multiple sources.
Queries free threat intelligence sources to provide context about IP addresses including reputation, geolocation, known malicious activity, and threat classifications.
Args: ip_address: IP address to enrich sources: List of sources to query (default: all available) Options: "abuseipdb", "alienvault", "threatfox", "internal"
Returns: Dictionary containing enrichment data from all sources: - reputation_score: 0-100 (100 = definitely malicious) - is_malicious: Boolean determination - threat_types: List of threat classifications - geolocation: Country, city, ISP information - last_seen: When this IP was last reported - reports_count: Number of abuse reports - confidence: Confidence score for the assessment
Inputs: ip_address (required), sources. Returns: result
Export harvested field labels in DeepTempo-compatible format.
This tool transforms field label data from harvest_labels() into a format that DeepTempo can consume for training and evaluation. The format is designed to be generic and adaptable to DeepTempo's specific needs.
Args: field_data: Output from harvest_labels() containing field metadata output_format: Format version ("deeptempo_v1" for now) save_to_file: Whether to save the export to a file file_path: Path for output file (default: ./deeptempo_labels_export.json)
Returns: Dictionary containing: - export_data: The formatted data ready for DeepTempo - file_path: Path where file was saved (if save_to_file=True) - summary: Statistics about the export
Inputs: field_data (required), file_path, save_to_file, output_format. Returns: result
Detect lateral movement patterns from a potentially compromised host.
Analyzes authentication attempts, rapid connections, privilege escalation indicators, and unusual protocols to identify lateral movement activity typical of advanced threats.
Args: source_ip: IP address of potentially compromised host time_window: Time window to analyze (default: "-7d") threshold: Minimum number of unique destinations to flag (default: 5)
Returns: Dictionary containing: - risk_score: 0-100 indicating likelihood of lateral movement - indicators: Boolean flags for various suspicious behaviors - timeline: Chronological list of authentication attempts - affected_hosts: List of systems that were contacted - recommendations: Suggested actions for analysts
Inputs: source_ip (required), threshold, time_window. Returns: result
Get detailed information about a specific field.
This tool provides deep analysis of a single field including value distribution, statistics, temporal information, and related fields that commonly appear together.
Args: field_name: Name of the field to analyze indexes: List of indexes to search (None = all indexes) timeframe: Time range to analyze (e.g., "-7d", "-30d")
Returns: Dictionary containing detailed field information: - field_name: The field name - type: Detected field type - total_unique_values: Count of unique values - top_values: Most common values with counts and percentages - first_seen: Earliest timestamp - last_seen: Latest timestamp - related_fields: Fields that commonly appear with this field - usage_by_sourcetype: Breakdown of usage by sourcetype
Inputs: field_name (required), indexes, timeframe. Returns: result
Get a list of all indexes and their sourcetypes.
This endpoint performs a search to gather:
All available indexes
All sourcetypes within each index
Event counts for each sourcetype
Time range information
Returns: Dict[str, Any]: Dictionary containing: - indexes: List of all accessible indexes - sourcetypes: Dictionary mapping indexes to their sourcetypes - metadata: Additional information about the search
Inputs: no named parameters. Returns: result
Get metadata for a specific Splunk index.
Args: index_name: Name of the index to get metadata for
Returns: Dictionary containing index metadata
Inputs: index_name (required). Returns: result
Get context and information about MITRE ATT&CK techniques and tactics.
Provides detailed information about attack techniques, tactics, and procedures to help analysts understand and categorize security findings.
Args: technique_id: MITRE ATT&CK technique ID (e.g., "T1071", "T1059.001") tactic: MITRE tactic name (e.g., "Command and Control", "Lateral Movement") search_term: Free-text search across techniques and descriptions
Returns: Dictionary containing: - techniques: List of matching techniques with details - tactics: Associated tactics - mitigations: Recommended mitigations - detections: Detection methods
Inputs: tactic, search_term, technique_id. Returns: result
Discover field labels and schemas from Splunk indexes.
This tool harvests field names, types, sample values, and metadata from Splunk indexes to support DeepTempo training and evaluation. It can discover all fields or focus on CIM (Common Information Model) fields only.
Args: indexes: List of specific indexes to harvest (None = all indexes) focus_cim: If True, only return common CIM fields (src_ip, dest_ip, user, etc.) max_sample_events: Number of events to sample for field value examples timeframe: Time range to analyze for field discovery (e.g., "-24h", "-7d")
Returns: Dictionary containing: - harvest_timestamp: ISO-8601 timestamp of harvest - indexes_analyzed: List of indexes analyzed - total_fields_discovered: Total number of unique fields found - fields: Dictionary mapping field names to their metadata
Inputs: indexes, focus_cim, timeframe, max_sample_events. Returns: result
Get basic Splunk connection information and list available apps (same as health_check but for endpoint consistency)
Inputs: no named parameters. Returns: result
Get basic Splunk connection information and list available apps
Inputs: no named parameters. Returns: result
Identify statistically rare events that may indicate threats.
Finds events, processes, domains, or patterns that occur very infrequently and may represent new attack techniques or zero-day exploits.
Args: index: Splunk index to analyze field: Field to analyze for rare values (e.g., "process_name", "domain") timeframe: Time range for baseline rarity_threshold: Percentage threshold for "rare" (0.01 = 1%)
Returns: Dictionary containing rare events and their frequencies
Inputs: field (required), index (required), timeframe, rarity_threshold. Returns: result
Isolate a compromised host from the network.
Quarantines a host by restricting its network access. This is typically implemented through network access control (NAC), endpoint security tools, or SDN/firewall rules.
Args: hostname: Hostname or IP to isolate isolation_level: "full" (complete isolation), "partial" (limited access), or "monitoring" (monitor only) reason: Reason for isolation duration_hours: Duration (0 = manual removal required)
Returns: Dictionary containing isolation status and details
Inputs: hostname (required), reason, duration_hours, isolation_level. Returns: result
Get a list of all available Splunk indexes.
Returns: Dictionary containing list of indexes
Inputs: no named parameters. Returns: result
List all KV store collections across apps.
Returns: List of KV store collections with metadata including app, fields, and accelerated fields
Inputs: no named parameters. Returns: result
List all saved searches in Splunk
Returns: List of saved searches with their names, descriptions, and search queries
Inputs: no named parameters. Returns: result
List all Splunk users (requires admin privileges)
Inputs: no named parameters. Returns: result
Simple ping endpoint to check server availability and get basic server information.
This endpoint provides a lightweight way to:
Verify the server is running and responsive
Get basic server information including version and server time
Check connectivity without making complex API calls
Returns: Dict[str, Any]: Dictionary containing status and basic server information
Inputs: no named parameters. Returns: result
Pivot on IP address across all indexes and sourcetypes for comprehensive analysis.
This is a critical tool for traditional SOC analyst workflows - it provides a complete view of all activity associated with an IP address, including network flows, authentication attempts, and data transfers.
Args: ip_address: IP address to pivot on (e.g., "10.1.42.42") timeframe: Splunk time modifier (e.g., "-30d", "-7d", "-1h") max_results: Maximum results to return per category
Returns: Comprehensive dictionary with all IP-related activity including: - Summary statistics (total events, unique destinations, time range) - Destination analysis (IPs contacted, ports, protocols) - Authentication events (users, success/failure, destinations) - Data transfer analysis (bytes in/out, top destinations) - Sourcetype distribution
Inputs: ip_address (required), timeframe, max_results. Returns: result
Execute arbitrary SPL query (alias for search_splunk, for compatibility with label harvester).
Args: query: The SPL query to execute earliest_time: Start time for the search (default: 24 hours ago) latest_time: End time for the search (default: now) max_results: Maximum number of results to return (default: 100)
Returns: List of search results
Inputs: query (required), latest_time, max_results, earliest_time. Returns: result
Execute a Splunk search query and return the results.
Args: search_query: The search query to execute earliest_time: Start time for the search (default: 24 hours ago) latest_time: End time for the search (default: now) max_results: Maximum number of results to return (default: 100)
Returns: List of search results
Inputs: search_query (required), latest_time, max_results, earliest_time. Returns: result
Send alert notifications to configured channels.
Pushes notifications to Slack, Microsoft Teams, PagerDuty, email, or SMS to ensure rapid response team awareness.
Args: message: Alert message to send channels: List of channels ("slack", "teams", "pagerduty", "email", "sms") severity: Alert severity level include_details: Whether to include full context in notification
Returns: Dictionary with delivery status for each channel
Inputs: message (required), channels, severity, include_details. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 31 tools
Several tools have overlapping purposes or are direct aliases (search_splunk/run_splunk_query, health_check/health). Additionally, check_ioc_reputation and enrich_ip_with_threat_intel both perform IP reputation checks, and list_indexes/get_indexes_and_sourcetypes overlap, creating ambiguity in tool selection.
Tool names follow a consistent snake_case verb_noun pattern (e.g., list_users, get_field_summary). Minor deviations include current_user (noun-first) and the alias pairs search_splunk/run_splunk_query and health_check/health, but these do not break the overall pattern.
31 tools is heavily above the typical well-scoped range. While the broad SOC scope justifies many tools, the presence of duplicate/overlapping tools inflates the count and suggests consolidation would be beneficial.
The tool set covers a wide range of SOC operations including search, threat intel, analytics, incident response, and DeepTempo integration. However, missing update/delete capabilities for saved searches, users, incidents, and threat list entries leave lifecycles incomplete and create dead ends for incident management.
AI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT.
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
SOAR security playbooks for AI agents: fetch, full-text search, and count. Metered via Stripe.
Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.
