Configure and manage streaming of audit events to SIEM destinations such as Splunk, Datadog, EventBridge, or webhooks. Check status, test connectivity, or forward events.
MIT
519,943 tools. Updated 2026-09-06 08:15
"Splunk" matching MCP tools:
- Update the SIEM push export destination for your organization, supporting Splunk and Datadog. Modify provider, endpoint, or token to configure where audit events are sent.MIT
- Retrieve the SIEM push export configuration for your organization, including provider, destination endpoint, and token status.MIT
- Send audit log events to your configured SIEM (Splunk HEC or Datadog Logs API) in a batched request. Returns the number of events pushed and the provider used.MIT
- Check server availability and get basic information like version and server time to verify connectivity without complex API calls.Apache 2.0
- Retrieve information about the currently authenticated Splunk user, including roles, permissions, and capabilities. Use it to verify user context and debug access issues in Splunk environments.Apache 2.0
Matching MCP Servers
- AlicenseBqualityFmaintenanceA FastMCP-based tool for interacting with Splunk Enterprise/Cloud through natural language. This tool provides a set of capabilities for searching Splunk data, managing KV stores, and accessing Splunk resources12107Apache 2.0
- FlicenseNot gradedqualityDmaintenanceA security-focused MCP server that enables automated log retrieval and threat analysis using LangGraph orchestration and RAG. It allows users to detect suspicious activity and generate structured security insights by integrating LLM reasoning with log data and runbook documentation.-
- List alert actions on Splunk to identify valid action names and parameter keys before creating or updating alerts, including custom actions.Apache 2.0
- Execute Splunk queries as tracked jobs to monitor progress, scan counts, and retrieve results for complex or long-running searches, ensuring reliable output within user permissions.Apache 2.0
- Run a Splunk search and retrieve immediate results for quick lookups, ad-hoc checks, or previews. Returns up to 10,000 events with execution timing and the query used.Apache 2.0
- Detect lateral movement from a compromised host by analyzing authentication attempts and connection patterns. Returns risk score and affected hosts for quick SOC response.Apache 2.0
- Discover available documentation topics, admin guides, SPL commands, and URI patterns. Use this to find relevant docs by category before requesting specific content.Apache 2.0
- List common Splunk configuration files with brief descriptions. Use this to identify available config files and then call get_config_spec() for detailed specifications.Apache 2.0
- Check Splunk server connectivity and retrieve server health, version, and system info. Test custom connection parameters to validate configurations and troubleshoot connectivity issues.Apache 2.0
- Retrieve current user's identity, roles, and default app settings to verify access permissions and user context during SOC operations.Apache 2.0
- Convert harvested field labels into a DeepTempo-compatible format for training and evaluation. Save to file with summary statistics.Apache 2.0
- Quarantine a compromised host by restricting network access. Choose full, partial, or monitoring isolation to contain threats and limit damage.Apache 2.0
- Dispatch alerts to Slack, Teams, PagerDuty, email, or SMS with severity and context to ensure rapid response.Apache 2.0
- List all KV store collections across Splunk apps, including app, fields, and accelerated field metadata, to support SOC investigations.Apache 2.0
- List all installed Splunk applications with metadata (name, version, author, visibility) to audit, manage, and troubleshoot. Obtain a full inventory for environment oversight.Apache 2.0
- Retrieve a complete inventory of all Splunk users and their properties for security audits, user management, and access pattern analysis. No arguments required.Apache 2.0
- Lists all 26 Splunk CIM data models with descriptions, use cases, required tags, and deprecation status to guide selection before referencing specific models.Apache 2.0