Kibana MCP Server
About
A Model Context Protocol (MCP) server that integrates with Kibana Security, enabling AI assistants to manage security alerts, detection rules, and exception lists programmatically.
Details
- Author
- ggilligan12
- GitHub stars
- 12
- Downloads
- 310
- Categories
- Other
Jump to
- Fetch security alerts via get_alerts
- Tag alerts with tag_alert
- Change alert status (open/acknowledged/closed)
- Search detection rules with find_rules
- Retrieve and add rule exception items
- Create and associate shared exception lists
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
Kibana MCP ServerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Clone the repository, build the Docker image, set environment variables (KIBANA_URL plus either KIBANA_API_KEY or KIBANA_USERNAME/KIBANA_PASSWORD), then configure your MCP client (e.g., Claude Desktop) to run the container. Alternatively, run locally with uv sync and uv run kibana-mcp.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"kibana mcp server": {
"kibana-mcp": {
"command": "docker",
"args": [
"build",
"-t",
"kibana-mcp",
"."
]
}
}
}
}McpServers
{
"kibana-mcp": {
"command": "docker",
"args": [
"build",
"-t",
"kibana-mcp",
"."
]
}
}Kibana MCP Server
Model Context Protocol (MCP) server for Kibana Security - manage alerts, rules, and exceptions via AI assistants.
Quick Start
1. Clone and Build
git clone https://github.com/ggilligan12/kibana-mcp.git
cd kibana-mcp
docker build -t kibana-mcp .
2. Configure MCP Client
Add to your MCP client config (Claude Desktop, Cursor, etc.):Option A: Using Environment Variables (Recommended)
First, set your credentials:
```bash
export KIBANA_URL="https://your-kibana.example.com:5601"
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
