広告掲載
MCP.so
ログイン

Kibana MCP Server

@ggilligan12

リポジトリ

基本情報

カテゴリ

その他

ライセンス

MIT

トランスポート

stdio

作者

ggilligan12

Kibana MCP Server について

MCP Server for Kibana SecOps

#kibana#mcp#mcp-server

Kibana MCP Server の設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": [
        "build",
        "-t",
        "kibana-mcp",
        "."
      ]
    }
  }
}

Kibana MCP Server のツール

8

Fetch security alerts

Add tags to alerts

Change alert status (open/acknowledged/closed)

Search detection rules

Get rule exception items

Add exceptions to rules

Create new exception lists

Link exception lists to rules

概要

What is Kibana MCP Server?

A Model Context Protocol (MCP) server that integrates with Kibana Security, enabling AI assistants to manage security alerts, detection rules, and exception lists programmatically.

How to use Kibana MCP Server?

Clone the repository, build the Docker image, set environment variables (KIBANA_URL plus either KIBANA_API_KEY or KIBANA_USERNAME/KIBANA_PASSWORD), then configure your MCP client (e.g., Claude Desktop) to run the container. Alternatively, run locally with uv sync and uv run kibana-mcp.

Key features of Kibana MCP Server

  • Fetch security alerts via get_alerts
  • Tag alerts with tag_alert
  • Change alert status (open/acknowledged/closed)
  • Search detection rules with find_rules
  • Retrieve and add rule exception items
  • Create and associate shared exception lists

Use cases of Kibana MCP Server

  • Automating alert triage from an AI chat interface
  • Bulk updating alert statuses during incident response
  • Adding exception rules to suppress known false positives
  • Orchestrating rule management across multiple Kibana instances

よくある質問

1

What authentication methods are supported?

You can authenticate using either a Kibana API key (recommended) or a username/password combination.

2

How do I configure the server for my MCP client?

Set `KIBANA_URL` and your credentials as environment variables, then add a Docker-based MCP server entry in your client configuration (e.g., Claude Desktop or Cursor). Direct credentials in the args are also supported.

3

Can I run the server locally without Docker?

Yes. Install dependencies with `uv sync`, set the required environment variables, and start the server with `uv run kibana-mcp`.

4

Is there a test environment provided?

Yes. The repository includes a `testing/quickstart-test-env.sh` script that starts a local Kibana/Elasticsearch instance preloaded with test data.

5

What tools does the server expose?

Eight tools: `get_alerts`, `tag_alert`, `adjust_alert_status`, `find_rules`, `get_rule_exceptions`, `add_rule_exception_items`, `create_exception_list`, and `associate_shared_exception_list`.

コメント

「その他」の他のコンテンツ

Klarix Intelligence Engine

Klarix

B2B competitive intelligence, live sales battlecards, 5-axis ICP prospect fit scoring, and tech stack teardowns over MCP and REST with cited public-web evidence.

Awesome Mlops

visenger

A curated list of references for MLOps

14.0K
N

Next Generation Movers: free moving quotes (remote MCP)

Next Generation Movers

Free moving quotes for AI agents from Next Generation Movers, a licensed interstate mover (USDOT 3764697). US long-distance nationwide and local DC/MD/VA. Indicative ballpark price and booking options; optional $0.01 x40

P

PickFu MCP

PickFu MCP is a Model Context Protocol (MCP) server that connects AI assistants, developers, marketers, product managers, and AI agents to PickFu's consumer research platform. It enables users to create surveys, conduct

FastMCP v2 🚀

jlowin

🚀 The fast, Pythonic way to build MCP servers and clients.

26.0K
広告掲載