devops-infra MCP Server
MCP server for Suricata IDS/IPS — EVE JSON log analysis, alert investigation, and rule management
Discovered via github-topic:mcp and last synced 3mo ago.
1. Install the package
npx suricata-mcp
2. Add to claude_desktop_config.json
{
"mcpServers": {
"suricata-mcp": {
"command": "npx",
"args": [
"suricata-mcp"
]
}
}
}Config file location: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) / %APPDATA%\Claude\claude_desktop_config.json (Windows)
Default
_(none)_
Search flows by IP, port, protocol, app protocol, bytes, duration, state
Interface capture statistics via Unix socket
Push a Suricata alert to TheHive for triage
_(none)_
`/var/log/suricata/`
_(none)_
Description
`/var/log/suricata/eve.json`
_(none)_
Top talkers, protocol distribution, bandwidth stats
Search rule files by SID, message, classtype, reference, content
Search conn.log by IP, port, protocol, service, duration, bytes, state
_(none)_
`1000`
Search alerts by SID, signature, category, severity, IP, port, protocol, action, time range
Search HTTP transactions by hostname, URL, method, status, user-agent
Enable or disable a rule by SID
_(none)_
_(none)_
_(none)_
Search DNS queries by name, source IP, record type, response code
Search MISP for IOCs (IP, domain, hash)
Network baseline report generation
Detect hosts with abnormally high outbound data transfer
Replay a PCAP through Zeek
Proactive threat hunting methodology
Search TLS connections by SNI, JA3/JA4, certificate subject/issuer
Search dns.log by query name, type, rcode
Time-bucketed alert counts with severity breakdown
Reload rules via Docker (suricata-update + SIGUSR2)
Search extracted files by name, magic type, hash, size
Detect C2 beaconing via connection interval analysis with jitter and confidence scoring
Search ssl.log by server name, TLS version
Full IR workflow with Suricata + Zeek + TheHive
Aggregated alert statistics grouped by signature, category, severity, source, or destination
Description
Daily alert summary report template
Capture, decoder, detect, and flow statistics
Search files.log by filename, MIME type, hash
Replay a PCAP through Suricata
Search protocol anomalies by type, source/destination IP
Live rule reload via Unix socket
Top alerts by frequency and severity with unique source/destination counts
Cross-correlate Suricata alerts with Zeek conn/dns/http/ssl logs by IP pair and time window
Description
Rule set statistics: total, enabled/disabled, by action, by classtype
Full host investigation across all event types
Search weird.log for protocol anomalies
Search SSH connections by client/server software version
Detect DGA domains using Shannon entropy analysis on DNS queries
Search ssh.log by client, server, auth success
Write a custom rule to local.rules
Deep alert investigation with correlated flow and protocol data
Search http.log by host, URI, method, status, user-agent
List available PCAP files
Guided alert investigation workflow
Detect internal-to-internal scanning on unusual ports
Top talkers, protocol and service distribution, bandwidth stats
Create a TheHive case from investigation findings