Incident Timeline MCP Server

Example Use Cases

• 1

  Analyze raw Slack or plaintext chat logs to generate structured incident timelines.

• 2

  Classify incident events by NIST SP 800-61 phases with severity and responder metrics.

• 3

  A hybrid approach combining regex extraction with LLM semantic enrichment for incident analysis.

Description

This MCP server processes Slack exports or plaintext chat logs to produce detailed incident timelines classified by NIST SP 800-61 incident response phases, severity assessments, responder metrics, and identified entities. It uses deterministic regex extraction for high-confidence data and Claude Haiku LLM enrichment for semantic classification where needed, improving accuracy while minimizing API usage. The tool supports noise filtering, user ID resolution, and multi-day exports, providing a comprehensive and structured incident report to aid security operations.