loading…
Multi-stage event correlation (Wazuh/Splunk/Sentinel), Defense Evasion detection, and custom correlation rule tuning.
/api/mcp/srv-siem-rule-correlation-engineeringMCP enable + token are only for calling from an external client — the playground below needs neither.
Analyze detection rule performance metrics including trigger frequency, false positive rate, and resource usage
{
"type": "object",
"required": [
"detection_id"
],
"properties": {
"time_range": {
"enum": [
"24h",
"7d",
"30d",
"90d"
],
"type": "string"
},
"detection_id": {
"type": "string"
},
"include_metrics": {
"type": "array",
"items": {
"enum": [
"trigger_count",
"false_positive_rate",
"execution_time",
"data_volume",
"coverage"
],
"type": "string"
}
}
}
}Create new correlation rule with search logic, triggering conditions, and notable event configuration
{
"type": "object",
"required": [
"name",
"search_query",
"severity",
"trigger_condition"
],
"properties": {
"name": {
"type": "string"
},
"enabled": {
"type": "boolean",
"default": true
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"query_type": {
"enum": [
"spl",
"kql",
"lucene"
],
"type": "string"
},
"description": {
"type": "string"
},
"search_query": {
"type": "string"
},
"mitre_techniques": {
"type": "array",
"items": {
"type": "string"
}
},
"trigger_condition": {
"type": "object",
"required": [
"threshold",
"time_window"
],
"properties": {
"group_by": {
"type": "array",
"items": {
"type": "string"
}
},
"threshold": {
"type": "integer"
},
"time_window": {
"type": "string"
}
}
},
"suppression_window": {
"type": "string"
}
}
}Retrieve a specific detection rule by ID including logic, metadata, and correlation settings
{
"type": "object",
"required": [
"detection_id"
],
"properties": {
"detection_id": {
"type": "string"
}
}
}Retrieve detailed notable event by event_id including triggering events, rule context, and investigation timeline
{
"type": "object",
"required": [
"event_id"
],
"properties": {
"event_id": {
"type": "string"
}
}
}Execute threat hunting query across historical data with pivot capabilities and IOC enrichment
{
"type": "object",
"required": [
"hunt_query"
],
"properties": {
"limit": {
"type": "integer",
"default": 10000
},
"hunt_query": {
"type": "string"
},
"query_type": {
"enum": [
"spl",
"kql",
"lucene"
],
"type": "string"
},
"enrich_iocs": {
"type": "boolean",
"default": false
},
"latest_time": {
"type": "string"
},
"data_sources": {
"type": "array",
"items": {
"type": "string"
}
},
"pivot_fields": {
"type": "array",
"items": {
"type": "string"
}
},
"earliest_time": {
"type": "string"
}
}
}List detection rules with filtering by status, severity, technique, and last modified date
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"status": {
"enum": [
"enabled",
"disabled",
"testing"
],
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"rule_type": {
"enum": [
"correlation",
"statistical",
"threshold",
"anomaly"
],
"type": "string"
},
"modified_since": {
"type": "string"
},
"mitre_technique": {
"type": "string"
}
}
}List notable events with filtering by urgency, status, owner, and time range
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"owner": {
"type": "string"
},
"status": {
"enum": [
"new",
"in_progress",
"pending",
"resolved",
"closed"
],
"type": "string"
},
"urgency": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"rule_name": {
"type": "string"
},
"latest_time": {
"type": "string"
},
"earliest_time": {
"type": "string"
}
}
}Search security events across data sources using SPL, KQL, or native query syntax with time range and field filters
{
"type": "object",
"required": [
"query"
],
"properties": {
"index": {
"type": "string"
},
"limit": {
"type": "integer",
"default": 1000
},
"query": {
"type": "string"
},
"query_type": {
"enum": [
"spl",
"kql",
"lucene",
"native"
],
"type": "string"
},
"sourcetype": {
"type": "string"
},
"latest_time": {
"type": "string"
},
"earliest_time": {
"type": "string"
}
}
}Modify correlation rule thresholds, time windows, field filters, and suppression conditions to reduce false positives
{
"type": "object",
"required": [
"rule_id"
],
"properties": {
"enabled": {
"type": "boolean"
},
"rule_id": {
"type": "string"
},
"threshold": {
"type": "integer"
},
"time_window": {
"type": "string"
},
"field_filters": {
"type": "object"
},
"suppression_conditions": {
"type": "array",
"items": {
"type": "object"
}
}
}
}Modify detection rule parameters including search logic, thresholds, and suppression settings
{
"type": "object",
"required": [
"detection_id"
],
"properties": {
"enabled": {
"type": "boolean"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"threshold": {
"type": "integer"
},
"time_window": {
"type": "string"
},
"detection_id": {
"type": "string"
},
"search_query": {
"type": "string"
},
"suppression_window": {
"type": "string"
}
}
}Update notable event status, owner assignment, and add disposition comments
{
"type": "object",
"required": [
"notable_id"
],
"properties": {
"owner": {
"type": "string"
},
"status": {
"enum": [
"new",
"in_progress",
"pending",
"resolved",
"closed"
],
"type": "string"
},
"comment": {
"type": "string"
},
"notable_id": {
"type": "string"
},
"disposition": {
"enum": [
"true_positive",
"false_positive",
"benign_positive",
"undetermined"
],
"type": "string"
}
}
}