Alert triage
6 tools (+1 demo). Compare how each tool runs, what it needs, where it sends data, what it can change and what its code can touch. Feed: /tasks/alert-triage/feed.xml
| Tool | Runs and needsWhere the tool runs and what must be in place before it works. | Sends data toOutside parties the tool contacts, read from the code and the documentation. Other connections are not ruled out. | Can change thingsWhether the tool's functions only read, or also create, change or delete things, run commands, or send data out. | How to run itThe run advice where we have read the tool under the verdict rule, else what the code shows; below it, whether it has run in our lab. |
|---|---|---|---|---|
| CrowdStrike Falcon MCP ServerDraft · awaiting review MCP server that connects agents to the CrowdStrike Falcon platform: detections, threat intel, host management and response. MCP server · CrowdStrike, pushed 2026-10-08 | Started by your client Works with: Any MCP client, Gemini CLI Needs: Access to a CrowdStrike console in which to create API credentials; A Falcon API client with its Client ID and Client Secret; the quickstart enables at minimum Hosts:read and Alerts:read; +4 more | CrowdStrike Falcon API, HTTP/HTTPS proxy, PyPI, quay.io | changes, deletes, runs commands | Code shows: can tunnel or exfiltrate · writes outside the project · changes config or installs globally · +1 more Ran once, 2026-11-07: did more than it said |
| GitGuardian MCP ServerDraft · awaiting review MCP server that brings GitGuardian secret detection, incident triage and honeytokens into an AI agent. MCP server · GitGuardian, pushed 2026-10-14 | At the vendor Works with: Any MCP client, Cursor Needs: A GitGuardian workspace (US or EU SaaS, or self-hosted) where a personal access token can be created in the dashboard; The code defines scan, incidents:read and sources:read as MINIMAL_SCOPES; +6 more | GitGuardian API, GitGuardian /multiscan, mcp.gitguardian.com, Sentry, GitGuardian dashboard login, github.com/GitGuardian/ggmcp | changes, runs commands, sends data out | Code shows: can tunnel or exfiltrate · writes outside the project · reads broad tokens or the environment · +2 more Ran once, 2026-11-07: did no more than it said |
| Google Security Operations MCP ServerDraft · awaiting review MCP server for Google Security Operations (Chronicle) with 68 tools for event search, alerts, detection rules, log ingestion and SIEM configuration. MCP server · google, pushed 2026-10-16 | Started by your client Works with: Any MCP client, Claude Code, Gemini CLI, Cursor Needs: A Google Security Operations (Chronicle) instance, identified by Google Cloud project ID, Chronicle customer ID and region; Google Cloud Application Default Credentials by default, set up with gcloud auth application-default login; +6 more | Google SecOps Chronicle API, Gemini in Chronicle, Chronicle natural-language translation | changes, deletes | Code shows: reads credential stores · changes config or installs globally · Approval: unknown Not run yet |
| Purple AI MCP ServerDraft · awaiting review Read-only MCP server for the SentinelOne Singularity platform: Purple AI, data-lake PowerQuery, alerts, vulnerabilities, misconfigurations and inventory. MCP server · Sentinel-One, pushed 2026-09-22 | Started by your client Works with: Any MCP client, Claude Code, Codex Needs: Needs a SentinelOne account to obtain the console token; Needs a console or Service User token with Account or Site scope, not Global, set as PURPLEMCP_CONSOLE_TOKEN; +4 more | SentinelOne console, SentinelOne Purple AI, Singularity Data Lake API, cve.circl.lu, VirusTotal, Pydantic Logfire, GitHub Sentinel-One/purple-mcp | reads, in the groups read | Code shows: can tunnel or exfiltrate · adds autostart, users or keys · reads broad tokens or the environment · +1 more Not run yet |
| SentinelOne MCP Server (s1-secops-mcp)Draft · awaiting review Node.js MCP server with 35 tools for the SentinelOne console, data lake, alert management and Hyperautomation, read-only by default. MCP server · Sentinel-One, pushed 2026-10-20 | Container Works with: Any MCP client, Claude Code Needs: S1_CONSOLE_URL and S1_CONSOLE_API_TOKEN, a Management Console API token of a service user or console user, used by the Mgmt API, UAM, PowerQuery and SDL tools; S1_HEC_TOKEN, an SDL Log Write Key minted for one account or site, is needed for hec_ingest only; +6 more | SentinelOne Management Console, Singularity Data Lake (<console>/sdl), Purple AI (console GraphQL), HEC ingest host, raw.githubusercontent.com, sentinelone/secops-mcps image | changes, deletes, runs commands | Code shows: writes outside the project · reads broad tokens or the environment · changes config or installs globally · +1 more Not run yet |
| SentinelOne AI Analyst: Claude SkillsDraft · awaiting review Claude plugin with eight SentinelOne skills for threat hunting, alert triage, detections, dashboards, parsers and Hyperautomation workflows. Plugin · Sentinel-One, pushed 2026-10-20 | Inside your AI client Works with: Claude Code Needs: A SentinelOne Management Console API token from a service user plus the console URL; Token role Viewer or higher for reads; IR Team or higher for response actions; +6 more | SentinelOne console and SDL APIs, Purple AI, VirusTotal, Shodan, cve-search.org (CIRCL), Docker Hub | changes, deletes, runs commands, sends data out | Code shows: can tunnel or exfiltrate · adds autostart, users or keys · writes outside the project · +3 more Not run yet |
| Example SIEM QueryDemo · fictional Builds and explains SIEM queries for alert triage from a short description of the alert. Skill · example, pushed 2026-10-02 | Inside your AI client Works with: Claude Code, Codex Needs: Access to your SIEM to run the query yourself; the skill holds no connection settings | none found in the files read | reads, in the groups read | Code shows: Secrets: unknown Not run yet |