Provides integration with Splunk for SOC operations, enabling cross-SIEM IOC hunting, alert investigation, and MITRE ATT&CK behavioral threat detection.
Enables automatic threat scoring and APT group tagging via VirusTotal for enhanced threat actor attribution.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@soc-siem-mcp Hunt for IOC 185.220.101.34 across all SIEMs and correlate with MITRE ATT&CK."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
A Model Context Protocol (MCP) server that empowers AI Assistants (Claude, ChatGPT, Gemini, and AI Aura) to perform SOC operations, investigate alerts, and hunt malicious actors across Azure Sentinel, Splunk, Wazuh, IBM QRadar, and Securonix.
Cross-SIEM IOC Hunting: Fan-out queries across all SIEM engines simultaneously to detect lateral movement.
MITRE ATT&CK Behavioral Hunts: Pre-mapped hunts for techniques like PowerShell obfuscation (T1059.001) and LSASS dumping (T1003).
CTI & Threat Actor Attribution: Automatic threat scoring and APT group tagging via VirusTotal.
Dual Transport: Supports stdio (Claude Desktop) and SSE / HTTP (ChatGPT, Gemini, AI Aura).
Related MCP server: MCP-SOC Middleware
git clone [https://github.com/](https://github.com/)<your-username>/soc-siem-mcp.git
cd soc-siem-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
cp .env.example .env****
Run with Docker
Bash
docker-compose up --build -d
ChatGPT / AI Aura / Gemini
Run the server in SSE mode (MCP_TRANSPORT=sse on port 8000).
Expose the port (or use Cloudflare Tunnel/ngrok).
Connect your assistant to: https://<your-domain>/sse (or import /openapi.json into Custom GPT Actions).
---
### 9. Git Commands to Push to GitHub
Run these commands in your project root directory:
```bash
# 1. Initialize git
git init -b main
# 2. Add all files
git add .
# 3. Create initial commit
git commit -m "feat: initial release of SOC Threat Hunting SIEM MCP Gateway"
# 4. Link to your GitHub repository
git remote add origin https://github.com/<your-username>/soc-siem-mcp.git
# 5. Push to GitHub
git push -u origin mainThis server cannot be deployed
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
AI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT.
Zero-secret MCP gateway for AI agents: risk-scored, audited calls with human-in-the-loop approval.
One MCP server over 253 data sources: Reddit, LinkedIn, YouTube, G2, search and AI answers.
