- Conduid
- Marketplace
- #siem
MCP servers tagged siem
30 live MCP servers tagged "siem", ranked by trust score. Tags come from package metadata and repository topics, so this list covers servers across every category that work with siem.
AiSOC
Open-source AI-powered Security Operations Center — alert fusion, purple-team drills, agent-assisted triage, MITRE ATT&CK investigation. MIT-licensed, self-hostable.
Scanner
Advanced Shodan-based scanner for discovering, verifying, and enumerating Model Context Protocol (MCP) servers and AI infrastructure tools over HTTP & SSE.
Wirken
The enterprise gateway for autonomous agents. Identity management, per-channel isolation, credential vault, per-session tamper-evident audit log.
AI Runbooks
No description published.
Altprobe Lab
collector
Rsigma
A complete Sigma detection toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:
Altprobe
collector
Adk Runbooks
No description published.
Fengarde
Open-source SIEM pipeline: raw security logs → OCSF → correlation rules → alerts. OT and IT in one pipeline. Local-first AI triage, 10-minute self-hosted quickstart.
Wazuh Openclaw Autopilot
🤖 Automate SOC alert triage and incident response in Wazuh with OpenClaw agents and MCP for efficient security operations.
Wazuh Autopilot
Autonomous AI SOC for Wazuh SIEM — 11 security-expert agents triage, correlate, investigate and plan responses 24/7, every action gated by two-tier human approval. Runs on OpenCla…
Huntable CTI Studio
Huntable CTI Studio is an AI-assisted cyber threat intelligence workbench that turns open-source CTI into Sigma rules.
Agentmetry
Local-first flight recorder for AI coding agents. Hash-chained audit trail, MITRE-mapped sequence detection, DLP. Forwards to the SIEM you already run.
WRG-11/wrg-sigma-rules
rule production corpus across 11 MITRE ATT&CK tactic categories. Standalone server + Claude Code plugin distribution.
Secops V3
This is an MCP (Model Context Protocol) server for interacting with Google's Chronicle Security Operations API.
Phishforge
Open-source phishing simulation — campaigns, templates, training
Anvilogic
Anvilogic — independent third-party profile of a public API surface, by API Evangelist. Anvilogic is an Agentic SecOps platform founded in 2019 by former SOC practitioners. It run…
Synapcores Soar
Open-core SOAR platform for the autonomous SOC. Tier-1 triage agents, immutable audit, MCP portal for examiners. Built on SynapCores.
Soc Stack
One-command self-hosted SOC lab for Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata, and MCP servers for homelab blue-team training.
Wazuh Enhanced
Enhanced Wazuh implementation: LLM chatbot assistant, PECA compliance detection rules, and custom plugins for interactive network graphs & NLQ search.
Wazuh SIEM
Monitor Wazuh SIEM with threat intel, network device logs, custom rules, active response, and Dockerized syslog collection
Runreveal
RunReveal — independent third-party profile of a public API surface, by API Evangelist. RunReveal is a unified security log management and detection platform that replaces traditi…
Barzel Central Gateway MCP Server
Enterprise Model Context Protocol governance gateway and MCP control plane for AI agent tool routing, identity-aware policy, risk scoring, approvals, routebooks, workflow simulati…
Klaxon
MCP server for Wazuh 5.x. Query any events or findings datastream, discover which schema fields are actually populated, run logtest. Generic tools instead of fifty narrow ones. 5.…
Sbomgate
Continuous SBOM diff & vulnerability watch with maintainer-change tracking
Edrgap
EDR coverage & bypass detector — reconciles MDM + EDR + AD inventories
Aiops Fabric
Plug-and-play, infrastructure-agnostic Enterprise AI Platform (ViewSense AI)
Splunk MCP Guard
Policy-enforcing proxy in front of any Splunk MCP server
Mike
A Splunk-native agent that turns SOC analyst reasoning into a queryable institutional knowledge graph, accessible from SPL, a Python CLI, and a Model Context Protocol server.
Elastic Genai Secops
Open, AI-assisted SecOps platform on the Basic-licensed Elastic Stack: SIEM, detection rules, alert correlation, PII masking, LLM triage with human review, and a read-only MCP ser…