Agent skill · security · aradotso
security-detections-mcp
Query unified Sigma, Splunk, Elastic, KQL, Sublime, and CrowdStrike security detection rules via MCP server with MITRE ATT&CK mapping and coverage analysis
Why this skill is useful
Adds executable scripts for querying and analyzing security detection rules across multiple platforms with MITRE ATT&CK integration, which the AI cannot generate on its own.
What it needs
Requires node installed locally. Requires detect.michaelhaag.org account access. About 8k tokens when loaded. Last updated 2026-08-04. 11 stars on the source repository.
What this skill does
security-detections-mcp Skill by ara.so — Security Skills collection An MCP (Model Context Protocol) server providing LLM access to 8,200+ security detection rules across Sigma, Splunk ESCU, Elastic, KQL, Sublime, and CrowdStrike CQL formats, with MITRE ATT&CK mapping, coverage analysis, and autonomous detection engineering. What It Does Unified detection search across 6 major security platforms (Sigma, Splunk, Elastic, KQL, Sublime, CrowdStrike) MITRE ATT&CK integration with 172 threat actors, 784 software, 4,362 actor-technique relationships Coverage analysis identifying gaps in detection by tactic/technique/actor ATT&CK Navigator layers exportable as JSON for visualization Autonomous detection pipeline from CTI ingestion to draft PR generation 81 MCP tools for detection engineering (local) or ~25 tools (hosted) 11 expert prompts for ransomware assessment, APT emulation, purple teaming Installation Local Installation (Full Power) Prerequisites: Node.js 18+ Detection rule repositories cloned locally Quick start with npx: Configure in Claude Desktop (claudedesktopconfig.json): Configure in Cursor (.cursor/settings.json): Configure in VS Code (settings.json): Hosted Installation (Zero Setup) Prerequisites: API token from detect.michaelhaag.org/account/tokens Free tier: 200 calls/day, read-only tools Claude Desktop (requires mcp-remote): VS Code / Cursor: Getting Detection Content Download all detection sources with sparse checkout: Then update environment variables to point to these paths. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aradotso/security-detections-mcp