$ loading_
Investigate security events in Splunk with natural-language querying and response automation.
Copy the install command and let the AI configure it · recommended for beginners
No copy-paste install info for "Splunk MCP for SOC Operations" yet — see the docs or source repo.
Query Splunk for logs related to IP 198.51.100.24 in the last 24 hours, group results by authentication, network connections, and alerts, then enrich with threat intelligence and assess the risk level.
A summary of key events for the IP, enriched threat intelligence, and a risk assessment.
Analyze the last 12 hours for possible lateral movement, focusing on unusual logins, remote connections between hosts, share access, and privilege escalation clues, and list the most suspicious users and hosts.
A list of suspicious lateral movement paths, involved accounts and devices, and evidence to review first.
For the current high-severity alert, extract relevant labels and context first, then provide response recommendations; if evidence is strong, suggest executable actions such as host isolation or IP blocking.
An investigation result including labels, context, response priority, and executable response actions.
Connect AI agents to Splunk and TheHive for triage and security operations.
Search Splunk logs, inject test data, and send triage emails.
Query Wazuh in natural language for triage, hunting, audits, and response.
Investigate threats and respond to incidents across security data with natural language.
Monitor AI agents with policy enforcement, audit logs, and risk blocking via Splunk MCP.
Query and automate 7,283+ security detection rules in one place.