广告合作
MCP.so
登录

Kibana MCP Server

@ggilligan12

代码仓库

基本信息

分类

其他

许可证

MIT

传输方式

stdio

作者

ggilligan12

关于 Kibana MCP Server

MCP Server for Kibana SecOps

#kibana#mcp#mcp-server

Kibana MCP Server 配置

使用下面的配置,将此服务器添加到你的 MCP 客户端。

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": [
        "build",
        "-t",
        "kibana-mcp",
        "."
      ]
    }
  }
}

Kibana MCP Server 工具

8

Fetch security alerts

Add tags to alerts

Change alert status (open/acknowledged/closed)

Search detection rules

Get rule exception items

Add exceptions to rules

Create new exception lists

Link exception lists to rules

概览

What is Kibana MCP Server?

A Model Context Protocol (MCP) server that integrates with Kibana Security, enabling AI assistants to manage security alerts, detection rules, and exception lists programmatically.

How to use Kibana MCP Server?

Clone the repository, build the Docker image, set environment variables (KIBANA_URL plus either KIBANA_API_KEY or KIBANA_USERNAME/KIBANA_PASSWORD), then configure your MCP client (e.g., Claude Desktop) to run the container. Alternatively, run locally with uv sync and uv run kibana-mcp.

Key features of Kibana MCP Server

  • Fetch security alerts via get_alerts
  • Tag alerts with tag_alert
  • Change alert status (open/acknowledged/closed)
  • Search detection rules with find_rules
  • Retrieve and add rule exception items
  • Create and associate shared exception lists

Use cases of Kibana MCP Server

  • Automating alert triage from an AI chat interface
  • Bulk updating alert statuses during incident response
  • Adding exception rules to suppress known false positives
  • Orchestrating rule management across multiple Kibana instances

常见问题

1

What authentication methods are supported?

You can authenticate using either a Kibana API key (recommended) or a username/password combination.

2

How do I configure the server for my MCP client?

Set `KIBANA_URL` and your credentials as environment variables, then add a Docker-based MCP server entry in your client configuration (e.g., Claude Desktop or Cursor). Direct credentials in the args are also supported.

3

Can I run the server locally without Docker?

Yes. Install dependencies with `uv sync`, set the required environment variables, and start the server with `uv run kibana-mcp`.

4

Is there a test environment provided?

Yes. The repository includes a `testing/quickstart-test-env.sh` script that starts a local Kibana/Elasticsearch instance preloaded with test data.

5

What tools does the server expose?

Eight tools: `get_alerts`, `tag_alert`, `adjust_alert_status`, `find_rules`, `get_rule_exceptions`, `add_rule_exception_items`, `create_exception_list`, and `associate_shared_exception_list`.

评论

其他 分类下的更多 MCP 服务器

Yuppsy

Yuppsy MCP: build and publish real estate websites from your AI assistant. Yuppsy lets your AI assistant create live websites for real estate agents and individual property listings. You don't need a designer or any code

Blender

ahujasid

Open-source MCP to use Blender with any LLM

23.6K

Handl

Handl speaks the Model Context Protocol. Your whole billing operation — projects, invoices, clients, reports, approvals — as tools any AI assistant can call, inside your autonomy rules.

Codelf

unbug

A search tool helps dev to solve the naming things problem.

14.2K

DeepMark

DeepMark helps teachers deliver rapid, consistent marking with meaningful feedback for every student — in a fraction of the time. What once took a week, now takes one free period.

广告合作