$ loading_
Hunt EVTX logs with lineage and rarity to expose real threats.
Copy the install command and let the AI configure it · recommended for beginners
No copy-paste install info for "SigmaLineage MCP" yet — see the docs or source repo.
Analyze these Windows EVTX security logs, trace process lineage after the suspicious login event, use rarity baselining to find anomalous execution, lateral movement, and privilege escalation, and summarize the key threats in timeline order.
A timeline-based kill chain analysis highlighting suspicious processes, abnormal parent-child relationships, rare behaviors, and high-risk alerts.
Perform contextual correlation on the EVTX logs behind these security alerts, use process lineage and historical rarity baselines to separate false positives from real threats, and explain the reasoning for each high-risk event.
A de-noised list of high-priority events with threat rationale and recommended response priority.
Inspect the EVTX logs from these endpoints, establish a baseline of common process behavior, identify rare command executions, script launches, and parent-child process combinations, and explain which patterns most likely indicate intrusion activity.
A summary of anomalous behavior listing the most suspicious rare patterns, affected hosts, and recommended next investigation steps.
Investigate threats and respond to incidents across security data with natural language.
Query and automate 7,283+ security detection rules in one place.
Retrieve normalized OpenCTI threat intelligence with context for indicators, actors, and reports.
Perform static taint analysis on Python code to detect security vulnerabilities.
Analyze Qlik Cloud data lineage to find unused fields and ghost files.
Extract structured incident timelines and phased security analysis from raw communication logs.