"Splunk" matching MCP servers:

A security-focused MCP server that enables automated log retrieval and threat analysis using LangGraph orchestration and RAG. It allows users to detect suspicious activity and generate structured security insights by integrating LLM reasoning with log data and runbook documentation.

Enables reading and building Splunk dashboards via the management REST API, using SSO for permissions and supporting both Studio and Classic formats.

Enforces security policies between AI assistants and Splunk by inspecting every search, mapping users to roles, and requiring human approval for write actions.

Enables running Splunk searches and reading their results against a Splunk Cloud deployment that requires interactive Microsoft Entra SSO and MFA, using a Playwright-managed authenticated browser session instead of API tokens.

A safety layer and monitoring copilot for AI agents using Splunk MCP, recording tool calls, enforcing policies, and blocking risky actions.

Enables AI-assisted SOC workflows by connecting Claude Desktop to Splunk Enterprise for security event analysis and incident response.

Enables AI agents to investigate Splunk exports or live queries using deterministic detectors and an iterative analysis loop, all running locally without data leaving the machine.

This read-only MCP Server allows you to connect to Splunk data from Claude Desktop through CData JDBC Drivers. For full CRUD support, check out the first managed MCP platform: CData Connect AI (https://www.cdata.com/ai/).

Provides tools to search Splunk logs, inject test data, and send triage emails, enabling AI-driven incident investigation.

Enables AI agents to interact with Splunk SIEM and TheHive SOAR through a unified MCP interface, providing 12 tools for alert triage, case management, and security operations.

Sigma detection rule writing, validation, and pySigma-based multi-backend conversion (Splunk, Elastic, Wazuh, Kibana) via 3 MCP tools and 3 Claude Code skills, backed by a 61-rule production corpus across 11 MITRE ATT\&CK tactic categories.

Unifies 7,283+ detection rules from Sigma, Splunk ESCU, Elastic, and KQL into a single queryable interface via MCP, with a web dashboard and autonomous agent pipeline for detection engineering.