Kibana MCP Server
About
A Model Context Protocol (MCP) server that integrates with Kibana Security, enabling AI assistants to manage security alerts, detection rules, and exception lists programmatically.
Details
- License
- MIT
Explore
- Fetch security alerts via get_alerts
- Tag alerts with tag_alert
- Change alert status (open/acknowledged/closed)
- Search detection rules with find_rules
- Retrieve and add rule exception items
- Create and associate shared exception lists
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Kibana MCP ServerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Add to your MCP client config (Claude Desktop, Cursor, etc.):
Option A: Using Environment Variables (Recommended)
First, set your credentials:
export KIBANA_URL="https://your-kibana.example.com:5601"
uv sync
- get_alerts - Fetch security alerts
- tag_alert - Add tags to alerts
- adjust_alert_status - Change alert status (open/acknowledged/closed)
- find_rules - Search detection rules
- get_rule_exceptions - Get rule exception items
- add_rule_exception_items - Add exceptions to rules
- create_exception_list - Create new exception lists
- associate_shared_exception_list - Link exception lists to rules
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"kibana mcp server": {
"kibana-mcp": {
"command": "docker",
"args": [
"build",
"-t",
"kibana-mcp",
"."
]
}
}
}
}McpServers
{
"kibana-mcp": {
"command": "docker",
"args": [
"build",
"-t",
"kibana-mcp",
"."
]
}
}
Model Context Protocol (MCP) server for Kibana Security - manage alerts, rules, and exceptions via AI assistants.
Quick Start
1. Clone and Build
git clone https://github.com/ggilligan12/kibana-mcp.git
cd kibana-mcp
docker build -t kibana-mcp .
2. Configure MCP Client
Add to your MCP client config (Claude Desktop, Cursor, etc.):Option A: Using Environment Variables (Recommended)
First, set your credentials:
```bash
export KIBANA_URL="https://your-kibana.example.com:5601"
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
