"Elastic" matching MCP servers:

Brings interactive blue-team security operations into AI hosts, enabling alert triage, attack discovery, case management, detection rules, threat hunting, and sample data generation with rich inline UIs.

Sigma detection rule writing, validation, and pySigma-based multi-backend conversion (Splunk, Elastic, Wazuh, Kibana) via 3 MCP tools and 3 Claude Code skills, backed by a 61-rule production corpus across 11 MITRE ATT\&CK tactic categories.

Enables comprehensive interaction with Elasticsearch APIs through natural language queries, specifically optimized for security analysis, threat detection, incident investigation, and compliance monitoring with advanced machine learning capabilities for anomaly detection.

Enables querying and analysis of a unified database of security detection rules across multiple formats, including Sigma, Splunk, Elastic, KQL, and CrowdStrike CQL.

Unifies 7,283+ detection rules from Sigma, Splunk ESCU, Elastic, and KQL into a single queryable interface via MCP, with a web dashboard and autonomous agent pipeline for detection engineering.