Detection engineering
4 tools (+1 demo). Compare how each tool runs, what it needs, where it sends data, what it can change and what its code can touch. Feed: /tasks/detection-engineering/feed.xml
| Tool | Runs and needsWhere the tool runs and what must be in place before it works. | Sends data toOutside parties the tool contacts, read from the code and the documentation. Other connections are not ruled out. | Can change thingsWhether the tool's functions only read, or also create, change or delete things, run commands, or send data out. | How to run itThe run advice where we have read the tool under the verdict rule, else what the code shows; below it, whether it has run in our lab. |
|---|---|---|---|---|
| Google Security Operations MCP ServerDraft · awaiting review MCP server for Google Security Operations (Chronicle) with 68 tools for event search, alerts, detection rules, log ingestion and SIEM configuration. MCP server · google, pushed 2026-10-16 | Started by your client Works with: Any MCP client, Claude Code, Gemini CLI, Cursor Needs: A Google Security Operations (Chronicle) instance, identified by Google Cloud project ID, Chronicle customer ID and region; Google Cloud Application Default Credentials by default, set up with gcloud auth application-default login; +6 more | Google SecOps Chronicle API, Gemini in Chronicle, Chronicle natural-language translation | changes, deletes | Code shows: reads credential stores · changes config or installs globally · Approval: unknown Not run yet |
| SentinelOne MCP Server (s1-secops-mcp)Draft · awaiting review Node.js MCP server with 35 tools for the SentinelOne console, data lake, alert management and Hyperautomation, read-only by default. MCP server · Sentinel-One, pushed 2026-10-20 | Container Works with: Any MCP client, Claude Code Needs: S1_CONSOLE_URL and S1_CONSOLE_API_TOKEN, a Management Console API token of a service user or console user, used by the Mgmt API, UAM, PowerQuery and SDL tools; S1_HEC_TOKEN, an SDL Log Write Key minted for one account or site, is needed for hec_ingest only; +6 more | SentinelOne Management Console, Singularity Data Lake (<console>/sdl), Purple AI (console GraphQL), HEC ingest host, raw.githubusercontent.com, sentinelone/secops-mcps image | changes, deletes, runs commands | Code shows: writes outside the project · reads broad tokens or the environment · changes config or installs globally · +1 more Not run yet |
| SentinelOne AI Analyst: Claude SkillsDraft · awaiting review Claude plugin with eight SentinelOne skills for threat hunting, alert triage, detections, dashboards, parsers and Hyperautomation workflows. Plugin · Sentinel-One, pushed 2026-10-20 | Inside your AI client Works with: Claude Code Needs: A SentinelOne Management Console API token from a service user plus the console URL; Token role Viewer or higher for reads; IR Team or higher for response actions; +6 more | SentinelOne console and SDL APIs, Purple AI, VirusTotal, Shodan, cve-search.org (CIRCL), Docker Hub | changes, deletes, runs commands, sends data out | Code shows: can tunnel or exfiltrate · adds autostart, users or keys · writes outside the project · +3 more Not run yet |
| Malware AnalystDraft · awaiting review Agent skill that walks through a static malware analysis: deobfuscation, IOC extraction and detection signatures. Skill · tomabai, pushed 2026-07-12 | Inside your AI client Works with: Claude Code Needs: Claude Code as the AI client; node for JavaScript decryptors and uv for Python decryptors when a layer needs a static decryptor | none found in the files read | changes, runs commands | Code shows: runs shell commands or eval · Secrets: unknown Not run yet |
| Example SIEM QueryDemo · fictional Builds and explains SIEM queries for alert triage from a short description of the alert. Skill · example, pushed 2026-10-02 | Inside your AI client Works with: Claude Code, Codex Needs: Access to your SIEM to run the query yourself; the skill holds no connection settings | none found in the files read | reads, in the groups read | Code shows: Secrets: unknown Not run yet |