Kibana MCP Server

Example Use Cases

• 1

  Fetch, filter, and review Kibana security alerts programmatically to prioritize triage workflows.

• 2

  Tag alerts and update alert statuses (open/acknowledged/closed) as part of automated incident response.

• 3

  Search detection rules, add exception items, create exception lists, and associate exceptions with rules to manage false positives.

Description

This repository provides a Model Context Protocol (MCP) server for Kibana Security that enables agents to fetch and manage security alerts, search and modify detection rules, and create or associate exception lists. It runs as a Docker container (or locally) and is designed to be added to MCP-enabled clients (e.g., Claude Desktop, Cursor) via environment-configured credentials. The server exposes tools to tag alerts, change alert status, find rules, and manage rule exceptions, streamlining automation of security triage and rule maintenance. It’s intended to simplify and secure automated interactions with Kibana using API keys or username/password authentication.