10 actions in 3 pieces of software · ranked by words, meaning and measured trust · 492 ms

1. 1security-detections-mcpverified and signedpassport

   skillreason-machines/security-skillsrecord

   • security-detections-mcp

     Query unified Sigma, Splunk, Elastic, KQL, Sublime, and CrowdStrike security detection rules via MCP server with MITRE ATT&CK mapping and coverage analysis

2. 2Security Detections MCPfound in code, not yet checkedno passport yet

   MCP serverMHaggis/Security-Detections-MCP

   • search

     Full-text search across all detection fields (name, description, query, MITRE IDs, tags, CVEs, analytic stories, process names, file paths, registry paths)

   • list_by_detection_type

     List detections by detection type (e.g., "TTP", "Anomaly", "Hunting", "Correlation").

   • smart_compare

     Compare detections across sources, tactics, or techniques for a given topic. Returns breakdown by source, tactic, and severity.

   • suggest_detections

     Get detection suggestions for a specific technique. Returns existing detections, required data sources, and detection ideas.

   • get_technique_full

     Full technique detail: all covering detections (paginated), actors using it, procedures, per-source breakdown.

   • list_all

     List detections with pagination. Prefer search() or list_by_* filters for targeted queries.

   • find_similar_detections

     Find existing detections similar to what you want to create. Use this to learn from existing detection logic and structure.

3. 3Security Detections MCPfound in code, not yet checkedno passport yet

   MCP serverthreadlinqs-cmd/Threadlinqs-Security-Detection-MCP

   • list_by_mitre

     List detections that map to a specific MITRE ATT&CK technique

   • list_all

     List all detections with pagination. Use for browsing the detection index.