Elastic Security MCP Server

Reference MCP app for Elastic Security that brings interactive SOC dashboards (alerts, cases, rules, Attack Discovery) into Claude, Cursor, and VS Code.

Security by Elastic API Key active

GitHub Docs

Overview

Elastic Security MCP App is a reference MCP application maintained by Elastic that exposes blue-team security operations from an Elasticsearch + Kibana stack inside MCP-compatible AI hosts like Claude Desktop, Cursor, VS Code, and Claude Code. Unlike a typical tool-only MCP server, it uses the MCP Apps extension to return inline React-based dashboards, forms, and investigation graphs that render directly inside the AI conversation.

The server connects to an Elasticsearch cluster (8.x or 9.x with Security enabled) using an API key, and exposes six interactive SOC capabilities: Alert Triage with AI verdict cards and process trees, Attack Discovery for AI-correlated attack chains with MITRE mapping, Case Management for SOC investigation workflows, Detection Rules browsing and tuning with KQL search, a Threat Hunt ES|QL workbench with D3 entity graphs, and a Sample Data generator that produces ECS security events for attack scenarios.

It is a reference/example implementation published under the official elastic GitHub organization. It is installed locally (typically via a one-click .mcpb bundle in Claude Desktop) and brokered to the user's own Elasticsearch cluster, so role-based access control and audit logging stay on the Elastic side.

Tools

Tool	Description
`Alert Triage`	Fetch and filter Elastic Security alerts, group by severity, render AI verdict cards, process trees, and network investigation views.
`Attack Discovery`	Return AI-correlated attack chain analyses with confidence scoring and MITRE ATT&CK mapping.
`Case Management`	Create, view, and update SOC investigation cases in Kibana with AI-assisted actions.
`Detection Rules`	Browse, search, and tune Elastic Security detection rules using KQL queries.
`Threat Hunt`	ES
`Sample Data`	Generate realistic ECS-formatted security events across predefined attack scenarios.

Setup Guide

Prerequisites

Node.js 22+
Elasticsearch 8.x or 9.x with Security enabled (Elastic Cloud trial works)
Kibana 8.x or 9.x (required for Cases, Rules, and Attack Discovery)
An Elasticsearch API key with appropriate viewer/editor and index access roles (see docs/permissions.md in the repo)

Fastest install (Claude Desktop)

Download the latest example-mcp-app-security.mcpb bundle from the Releases page and double-click it in Claude Desktop. When prompted, paste your Elasticsearch URL, Kibana URL, and API key.

Manual install from source

git clone https://github.com/elastic/example-mcp-app-security.git
cd example-mcp-app-security
npm install
npm run build
npm start

The server listens at http://localhost:3001/mcp.

Environment variables

Create a .env file. Either inline the cluster config:

CLUSTERS_JSON='[{"name":"primary","elasticsearchUrl":"https://your-cluster.es.cloud.example.com","kibanaUrl":"https://your-cluster.kb.cloud.example.com","elasticsearchApiKey":"your-api-key"}]'

Or point at a JSON file (preferred, keeps secrets out of .env):

CLUSTERS_FILE=/absolute/path/to/clusters.json

Claude Desktop config (manual)

{
  "mcpServers": {
    "elastic-security": {
      "command": "node",
      "args": ["/absolute/path/to/example-mcp-app-security/dist/index.js"],
      "env": {
        "CLUSTERS_FILE": "/absolute/path/to/clusters.json"
      }
    }
  }
}

For Cursor, VS Code, Claude Code, and Claude.ai (via cloudflared tunnel), see the host-specific setup guides under the repo's /docs folder.

Use Cases

Triage the latest critical Elastic Security alerts and explore the process tree for any suspicious host without leaving the chat.
Run Attack Discovery to surface AI-correlated attack chains and map them to MITRE ATT&CK techniques during an incident.
Create and update Kibana cases (with comments, severity, and assignees) directly from a conversation while investigating.
Author and tune detection rules with KQL queries, then enable/disable them after review.
Use the ES|QL Threat Hunt workbench to pivot across entities and visualize relationships in a D3 graph.
Generate ECS-compliant sample attack data for demos, training, or rule development.

Example Prompts

"Show me all open critical alerts from the last 24 hours and group them by host."
"Run Attack Discovery on the last 12 hours and summarize the highest-confidence attack chains with their MITRE techniques."
"Open a new case titled 'Suspicious PowerShell on web-01', assign it to me, and add the top three related alerts as comments."
"Find all detection rules tagged 'Linux' that are currently disabled, and propose tuning changes."
"Use ES|QL to list the top 10 user.name values authenticating from new source IPs in the last 7 days."

Pros

Published under the official elastic GitHub organization with a Security Labs writeup.
Uses the MCP Apps extension to render real interactive dashboards (process trees, D3 graphs, verdict cards) inside the chat, not just text responses.
Covers a broad slice of SOC workflows: alerts, Attack Discovery, cases, rules, ES|QL hunting, and sample-data generation.
One-click .mcpb install for Claude Desktop with secure local API-key auth to your own cluster.

Limitations

Explicitly positioned as a reference/example app, not a hardened production integration.
Requires a working Elastic stack (Elasticsearch 8.x/9.x + Kibana) and a properly scoped API key, so onboarding is heavier than a simple SaaS connector.
Interactive dashboard rendering depends on MCP Apps support in the host; non-supporting clients will get a degraded experience.

Alternatives

Self-hosting the Elasticsearch MCP server for raw index/search access without the SOC dashboards.
Community Kibana or SIEM-focused MCP servers listed in the awesome-cyber-security-mcp catalog.
Building a thin custom MCP wrapper over the Kibana Security and Cases REST APIs when only specific endpoints are needed.