How do I use SigmaLineage MCP?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@SigmaLineage MCP run sigma hunt on last night's evtx and trace lineage" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

SigmaLineage MCP

by MohitDabas

Overview Schema Source Related Servers Discussions Admin

Python

Local

⚔️ SigmaLineage MCP

Context-Aware EVTX Hunting · Lineage-First Triage · Zero Noise Tolerance

"A Sigma hit means nothing without its story. The process lineage chain is the story."

🎯 Why SigmaLineage?

EVTX triage in modern SOCs is a race against noise. You have millions of events, hundreds of alerts, and seconds to decide what's real.

🔍 For the SOC Analyst

Generic alerts drown true incidents in false positives. You don't need more alerts — you need signal from noise.

SigmaLineage's rarity baseline engine automatically surfaces:

🚨 Anomalous process-to-port connections
👤 Suspicious user-log event signatures
🌐 Weird URL lookups no one else made

Find the real threat. Fast.

🧬 For the Detection Engineer

A Sigma rule fires. But is it a sysadmin doing their job, or an attacker moving laterally?

The process lineage chain is our core moat.

SigmaLineage traces the full parent→child execution tree — up to 5+ generations — turning isolated alerts into a visual kill chain. You instantly see:

Was this cmd.exe spawned by services.exe or w3wp.exe?
Is rundll32 being launched from ProgramData?
Did WmiPrvSE.exe just spawn a reverse shell?

Stop chasing ghosts. Confirm the kill chain.

🧠 By combining rapid Sigma matching, automated lineage graphing, and multi-dimensional rarity baselining, SigmaLineage MCP transforms raw EVTX logs into actionable, context-rich intelligence — for AI agents and human analysts alike.

Related MCP server: EventWhisper

🔧 Built On

Component	Role
`src/sigmalineage_mcp/mappings/sigma-event-logs-all.yml`	Chainsaw field-mapping definition
`sigma_lineage.py`	Process lineage runner script
`src/sigmalineage_mcp/`	FastMCP server orchestration

Tool Overview

1) `run_sigma`

Runs the Chainsaw Sigma hunt command and returns a summary of rule hits.

Inputs:

evtx_path (file or folder of logs to scan)
sigma_rules_path (directory containing Sigma rules)
mapping_path (Chainsaw mapping yaml, defaults to src/sigmalineage_mcp/mappings/sigma-event-logs-all.yml)
output_dir (directory where hunt.json is written)

Output Highlights:

hunt_json_path
hit_count
top_rules
top_source_files

2) `run_sigma_lineage`

Runs the Sigma hunt (or loads existing results) and traces the parent/child process lineage for hit processes.

Inputs:

All run_sigma inputs
levels (number of ancestor levels to trace, default 5)
skip_hunt (skip running Chainsaw hunt, loading existing hunt.json instead, default false)

Output Highlights:

hunt_json_path
process_lineage_json_path
process_lineage_md_path
sigma_hit_count
indexed_evtx_files
indexed_events

Example Lineage Highlights Output:

3) `rare_events_baseline`

Computes rare tuple combinations from parsed CSV event logs with baseline comparison to highlight anomalies.

Inputs:

target_csv_path (CSV file or folder to analyze)
baseline_csv_path (optional, defaults to target scope itself)
max_results (default 25)
max_baseline_count (filter threshold for baseline occurrence, default 2)

Tuple Families Analyzed:

process_dst_port_protocol: Maps unique combinations of process name, destination port, and protocol.
user_channel_event_id: Maps unique combinations of user, log channel, and event ID.
url_host_process: Maps unique combinations of accessed URL/domain, host computer, and initiating process name.

Example Rarity Baseline Analysis Output: Rarity Analysis

Folder Structure

sigmalineage-mcp/
  sigma_lineage.py            # Lineage tracer CLI script
  pyproject.toml              # Project configuration & dependencies
  README.md                   # This file
  src/
    sigmalineage_mcp/
      __init__.py
      __main__.py             # Standard script entrypoint
      config.py               # Paths configuration
      server.py               # FastMCP server orchestration
      mappings/
        sigma-event-logs-all.yml  # Chainsaw mapping file
      services/
        chainsaw_runner.py    # Subprocess runner for Chainsaw
        lineage_runner.py     # Subprocess runner for lineage tracer
        rarity.py             # Pure Python CSV rarity baseline engine

Installation

Prerequisites

Chainsaw CLI: Ensure chainsaw is installed and available in your PATH (e.g. at ~/.local/bin/chainsaw).
Python: Python 3.10+ is required.

Setup

From the repository root:

uv sync

Running the Server

Direct Execution

Start the FastMCP stdio server:

uv run sigmalineage-mcp

MCP Client Configurations

To wire this MCP server into different AI clients, use the standard JSON configuration snippet below, placing it in the tool-specific configuration file location.

Standard JSON Snippet

{
  "mcpServers": {
    "sigmalineage-mcp": {
      "command": "uv",
      "args": [
        "run",
        "--project",
        "/absolute/path/to/sigmalineage_mcp",
        "sigmalineage-mcp"
      ],
      "env": {
        "SIGMALINEAGE_PROJECT_ROOT": "/absolute/path/to/sigmalineage_mcp"
      }
    }
  }
}

Note: Replace /absolute/path/to/sigmalineage_mcp with the actual path where this repository is cloned on your system.

Client Configuration File Paths

Cursor: Add to the Cursor GUI settings panel (Settings -> Features -> MCP) or edit ~/.cursor/mcp.json (Linux/macOS) or %USERPROFILE%\.cursor\config\mcp.json (Windows).
Antigravity: Add to the mcp_config.json configuration file located at ~/.gemini/antigravity/mcp_config.json.
OpenCode: Add to ~/.config/opencode/opencode.json (Linux/macOS) or a project-level opencode.json file in the root of the repository.
Claude Desktop: Add to the global configuration file:
- macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
- Windows: %APPDATA%\Claude\claude_desktop_config.json
- Linux: ~/.config/Claude/claude_desktop_config.json

Available Tools

3 tools

rare_events_baselineC

Return rare tuple events with baseline frequencies from parsed CSV data.

ParametersJSON Schema

Name	Required	Description	Default
`max_results`	No
`target_csv_path`	Yes
`baseline_csv_path`	No
`max_baseline_count`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

C2.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must disclose behavioral traits. However, it only mentions reading CSV data and returning results, without stating whether the tool is read-only, what happens on errors, or any side effects. The agent cannot assess safety or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, concise and to the point. However, it sacrifices necessary detail for brevity. It could be more informative without becoming wordy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema, the description does not explain what 'rare tuple events' are, how baseline frequencies are computed, or the output structure. The tool has 4 parameters and an output schema, yet the description omits crucial context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain parameters. It hints at CSV paths but does not describe max_results, max_baseline_count, or their defaults. The agent cannot deduce the meaning of these parameters from the description alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the tool returns rare tuple events with baseline frequencies from parsed CSV data. This is a specific verb-resource combination, but it does not differentiate from sibling tools run_sigma and run_sigma_lineage, which likely have overlapping purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, nor does it specify prerequisites or context. The agent is left without criteria for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_sigmaC

Run Chainsaw Sigma hunt and return hunt.json summary.

ParametersJSON Schema

Name	Required	Description	Default
`evtx_path`	Yes
`output_dir`	Yes
`mapping_path`	Yes
`sigma_rules_path`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

C2.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It only mentions returning a summary, but does not explain side effects (e.g., creating output files, deleting anything, required permissions). No mention of whether it modifies input files or requires network access.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (one sentence) but at the expense of necessary detail. It is not verbose, but the minimalism leaves gaps that reduce its overall utility.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given four required string parameters, a tool name implying a security workflow, and the existence of an output schema (though not detailed), the description is insufficient. It does not explain the workflow, prerequisites, or what the output contains, leaving the agent underinformed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain parameters. It does not describe any of the four parameters (evtx_path, sigma_rules_path, mapping_path, output_dir) beyond their names, providing no added meaning for an AI agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs a Chainsaw Sigma hunt and returns a summary, using a specific verb ('Run') and resource ('Chainsaw Sigma hunt'). It distinguishes itself from siblings like 'rare_events_baseline' and 'run_sigma_lineage' by focusing on a general Sigma hunt, implying a different scope or output.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool over alternatives, no prerequisites, no exclusions. It simply states what it does without context about when it's appropriate, leaving the agent to guess.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_sigma_lineageC

Run Sigma hunt + process lineage tracing and return process_lineage paths/summary.

ParametersJSON Schema

Name	Required	Description	Default
`levels`	No
`evtx_path`	Yes
`skip_hunt`	No
`output_dir`	Yes
`mapping_path`	Yes
`sigma_rules_path`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
No output parameters

TDQS

C2.4/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden. It mentions running a hunt and lineage tracing, and returning results, but does not disclose side effects like file writes to output_dir, required permissions, or whether it modifies input data. The read-only or destructive nature is unclear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, which is concise but at the cost of clarity. It front-loads the core action but omits necessary details. It is not verbose, but brevity reduces utility.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 6 parameters (4 required) and a complex workflow (hunt + lineage), the description is severely incomplete. It does not explain prerequisites, output format (despite having an output schema), or typical use cases. The description fails to provide a minimal operational context for the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description adds no meaning to parameters. It mentions evtx_path, sigma_rules_path, mapping_path, and output_dir implicitly, but does not define them, their formats, or relationships. Parameters 'levels' and 'skip_hunt' are completely ignored, offering no guidance on usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it runs a Sigma hunt with lineage tracing, returning paths/summary. It implies a combination of hunt and lineage steps, distinguishing it from 'run_sigma' sibling which likely does only the hunt. However, it could be more explicit about what 'process_lineage paths/summary' entails.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus siblings. Sibling 'run_sigma' suggests a simpler hunt-only option, but the description does not explain the trade-offs (e.g., when lineage is needed). No when-not or alternative context provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

3 tool updatesv0.1.0Jun 27, 2026
- First observedrare_events_baseline
- First observedrun_sigma
- First observedrun_sigma_lineage

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

B3/5.0

Scored 2026-06-27 13:25 across 3 tools

Disambiguation5/5

Each tool has a distinct purpose: one focuses on rare event baselines, another on Sigma hunts, and the third on Sigma hunts with lineage tracing. There is no overlap or ambiguity.

Naming Consistency3/5

The first tool uses a noun phrase pattern (rare_events_baseline), while the other two use a verb-noun pattern (run_sigma, run_sigma_lineage). This inconsistency in naming style may cause confusion for an agent.

Tool Count4/5

With 3 tools, the set is slightly small but well-scoped for the domain. Each tool serves a clear function without unnecessary bloat, fitting within the typical 3-15 range.

Completeness4/5

The tools cover the core workflows: baseline analysis, sigma hunts, and lineage tracing. There are minor gaps (e.g., no tool for managing rules or results), but the surface is complete for intended use.

Maintenance

ActivityStale

ResponsivenessNo issues

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

ContrastAPI A
com.contrastcyber
55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
Security Penetration Testing AI & Machine Learning
55233
oracle42-intelligence
io.github.mintmas
AI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT.
Security Blockchain Penetration Testing
2
Crimson Crawler
com.crimsoncrawler
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Security Search Research & Data
1
cve-intelligence A
com.cve-security
CVE intelligence: exploitation (KEV/EPSS), detection coverage, fixed versions. All tools keyless.
Security Monitoring Observability
81

Related MCP Servers

WinLog-mcp
Monitoring Observability Security
XD3an
A
license
Not graded
quality
D
maintenance
Provides programmatic access to ingest and query Windows event logs (especially Sysmon logs), enabling security monitoring, incident response, and log analysis automation.
Updated a year ago (2025-05-21 16:49 UTC)
5
MIT
EventWhisper
Security OS Automation
Hexastrike
A
license
Not graded
quality
D
maintenance
Enables fast, scriptable access to Windows .evtx event logs for incident response and digital forensics. Supports filtering events by time windows, Event IDs, and keywords with field projection to reduce output size.
Updated a year ago (2025-08-25 19:16 UTC)
49
GPL 3.0
Windows Forensics MCP Server
Security OS Automation Databases
x746b
A
license
B
quality
A
maintenance
Enables AI-assisted Windows digital forensics analysis including parsing Windows Event Logs (EVTX), analyzing registry hives (SAM, SYSTEM, SOFTWARE), and remotely collecting artifacts via WinRM with built-in security queries and forensic reference data.
Updated 12 days ago (2026-09-03 17:58 UTC)
43
21
MIT
CrowdSentinel MCP Server
Observability Security
thomasxm
A
license
Not graded
quality
A
maintenance
Enables natural language threat hunting and incident response by connecting LLMs to enterprise security data sources like Elasticsearch, EVTX logs, PCAP files, and Velociraptor.
Updated 2 months ago (2026-07-19 21:09 UTC)
206
GPL 3.0

⚔️ SigmaLineage MCP

Context-Aware EVTX Hunting · Lineage-First Triage · Zero Noise Tolerance

🎯 Why SigmaLineage?

🔍 For the SOC Analyst

🧬 For the Detection Engineer

🔧 Built On

Tool Overview

1) run_sigma

2) run_sigma_lineage

3) rare_events_baseline

Folder Structure

Installation

Prerequisites

Setup

Running the Server

Direct Execution

MCP Client Configurations

Standard JSON Snippet

Client Configuration File Paths

Available Tools

Output Schema

Output Schema

Output Schema

Tool Schema Changelog

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

1) `run_sigma`

2) `run_sigma_lineage`

3) `rare_events_baseline`