MCP.so
ログイン

Kibana MCP Server

@ggilligan12

リポジトリ

Kibana MCP Server について

MCP Server for Kibana SecOps

#kibana#mcp#mcp-server

基本情報

カテゴリ

その他

ライセンス

MIT

ランタイム

python

トランスポート

stdio

公開者

ggilligan12

設定

以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": [
        "build",
        "-t",
        "kibana-mcp",
        "."
      ]
    }
  }
}

ツール

8

Fetch security alerts

Add tags to alerts

Change alert status (open/acknowledged/closed)

Search detection rules

Get rule exception items

Add exceptions to rules

Create new exception lists

Link exception lists to rules

概要

What is Kibana MCP Server?

A Model Context Protocol (MCP) server that integrates with Kibana Security, enabling AI assistants to manage security alerts, detection rules, and exception lists programmatically.

How to use Kibana MCP Server?

Clone the repository, build the Docker image, set environment variables (KIBANA_URL plus either KIBANA_API_KEY or KIBANA_USERNAME/KIBANA_PASSWORD), then configure your MCP client (e.g., Claude Desktop) to run the container. Alternatively, run locally with uv sync and uv run kibana-mcp.

Key features of Kibana MCP Server

  • Fetch security alerts via get_alerts
  • Tag alerts with tag_alert
  • Change alert status (open/acknowledged/closed)
  • Search detection rules with find_rules
  • Retrieve and add rule exception items
  • Create and associate shared exception lists

Use cases of Kibana MCP Server

  • Automating alert triage from an AI chat interface
  • Bulk updating alert statuses during incident response
  • Adding exception rules to suppress known false positives
  • Orchestrating rule management across multiple Kibana instances

FAQ from Kibana MCP Server

What authentication methods are supported?

You can authenticate using either a Kibana API key (recommended) or a username/password combination.

How do I configure the server for my MCP client?

Set KIBANA_URL and your credentials as environment variables, then add a Docker-based MCP server entry in your client configuration (e.g., Claude Desktop or Cursor). Direct credentials in the args are also supported.

Can I run the server locally without Docker?

Yes. Install dependencies with uv sync, set the required environment variables, and start the server with uv run kibana-mcp.

Is there a test environment provided?

Yes. The repository includes a testing/quickstart-test-env.sh script that starts a local Kibana/Elasticsearch instance preloaded with test data.

What tools does the server expose?

Eight tools: get_alerts, tag_alert, adjust_alert_status, find_rules, get_rule_exceptions, add_rule_exception_items, create_exception_list, and associate_shared_exception_list.

コメント

「その他」の他のコンテンツ

Awesome Mlops

visenger

A curated list of references for MLOps

14.0K

Inbox Zero AI

elie222

The world's best AI personal assistant for email. Open source app to help you reach inbox zero fast.

11.6K

Unity MCP ✨

justinpbarnett

Unity MCP acts as a bridge between AI assistants and your Unity Editor. Give your LLM tools to manage assets, control scenes, edit scripts, and automate tasks within Unity.

12.2K

MaxKB

1Panel-dev

🔥 MaxKB is an open-source platform for building enterprise-grade agents. 强大易用的开源企业级智能体平台。

22.0K

🚀 Model Context Protocol (MCP) Curriculum for Beginners

microsoft

This open-source curriculum introduces the fundamentals of Model Context Protocol (MCP) through real-world, cross-language examples in .NET, Java, TypeScript, JavaScript, Rust and Python. Designed for developers, it focuses on practical techniques for building modular, scalable,

16.7K