soc-siem-mcp
Provides integration with Splunk for SOC operations, enabling cross-SIEM IOC hunting, alert investigation, and MITRE ATT&CK behavioral threat detection.
Enables automatic threat scoring and APT group tagging via VirusTotal for enhanced threat actor attribution.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@soc-siem-mcpHunt for IOC 185.220.101.34 across all SIEMs and correlate with MITRE ATT&CK."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
soc-siem-mcp-
🛡️ SOC & Threat Hunting Unified SIEM MCP Gateway
A Model Context Protocol (MCP) server that empowers AI Assistants (Claude, ChatGPT, Gemini, and AI Aura) to perform SOC operations, investigate alerts, and hunt malicious actors across Azure Sentinel, Splunk, Wazuh, IBM QRadar, and Securonix.
🚀 Features
Cross-SIEM IOC Hunting: Fan-out queries across all SIEM engines simultaneously to detect lateral movement.
MITRE ATT&CK Behavioral Hunts: Pre-mapped hunts for techniques like PowerShell obfuscation (
T1059.001) and LSASS dumping (T1003).CTI & Threat Actor Attribution: Automatic threat scoring and APT group tagging via VirusTotal.
Dual Transport: Supports stdio (Claude Desktop) and SSE / HTTP (ChatGPT, Gemini, AI Aura).
Related MCP server: MCP-SOC Middleware
🛠️ Quickstart
1. Clone & Setup
git clone [https://github.com/](https://github.com/)<your-username>/soc-siem-mcp.git
cd soc-siem-mcp
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
cp .env.example .env****
Run with Docker
Bash
docker-compose up --build -d
ChatGPT / AI Aura / Gemini
Run the server in SSE mode (MCP_TRANSPORT=sse on port 8000).
Expose the port (or use Cloudflare Tunnel/ngrok).
Connect your assistant to: https://<your-domain>/sse (or import /openapi.json into Custom GPT Actions).
---
### 9. Git Commands to Push to GitHub
Run these commands in your project root directory:
```bash
# 1. Initialize git
git init -b main
# 2. Add all files
git add .
# 3. Create initial commit
git commit -m "feat: initial release of SOC Threat Hunting SIEM MCP Gateway"
# 4. Link to your GitHub repository
git remote add origin https://github.com/<your-username>/soc-siem-mcp.git
# 5. Push to GitHub
git push -u origin mainThis server cannot be installed
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- Alicense-qualityDmaintenanceAn AI-powered security operations platform that integrates with SIEM, EDR, and case management systems via MCP to automate incident response and investigation workflows. It provides specialized tools for alert triage, threat intelligence enrichment, and endpoint remediation across vendor-neutral APIs.46MIT
- Alicense-qualityCmaintenanceEnables AI agents to interact with Splunk SIEM and TheHive SOAR through a unified MCP interface, providing 12 tools for alert triage, case management, and security operations.MIT
- AlicenseAqualityAmaintenanceAI-powered MCP server that enables security analysts to query Wazuh SIEM/XDR for alert triage, threat hunting, compliance audits, and incident response through natural language prompts.2813MIT
- Alicense-qualityDmaintenanceUnifies 7,283+ detection rules from Sigma, Splunk ESCU, Elastic, and KQL into a single queryable interface via MCP, with a web dashboard and autonomous agent pipeline for detection engineering.1661Apache 2.0
Related MCP Connectors
AI-powered threat intelligence, smart contract auditing, and cybersecurity OSINT.
Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/JoaquinHernandez/soc-siem-mcp-'
If you have feedback or need assistance with the MCP directory API, please join our Discord server