suricata-mcp

Active

Chasing one Suricata alert means pivoting by hand across eve.json, flow records, DNS/HTTP/TLS transactions, and the Zeek logs next to them, slow and easy to get wrong under pressure. suricata-mcp hands the whole NSM stack to your agent: alerts, flows, protocols, Zeek metadata, and C2/DGA/exfil analytics, answered in plain language over stdio.

GitHub repo → npm →
$npx -y suricata-mcp
read-only defaultNode 20+

See it workrepresentative session

you
One host keeps phoning out at regular intervals. Is 192.0.2.24 beaconing to a C2, and what does Zeek say about it?
tool
suricata_beaconing_detection{ src_ip: "192.0.2.24", range: "6h", min_confidence: 0.7 }
result
1 candidate 192.0.2.24 -> 203.0.113.88:443 interval ~60s jitter 4% count 312 confidence 0.94
tool
correlate_alert_with_zeek{ src_ip: "192.0.2.24", dst_ip: "203.0.113.88", range: "6h" }
result
ssl.log SNI cdn-update.example JA3 771,4865-4866... self-signed cert conn.log 312 conns avg 1.2s 1.4KB up / 380B down each
agent
192.0.2.24 is beaconing to 203.0.113.88 every ~60s at 4% jitter, 0.94 confidence, over TLS with a self-signed cert and steady small uplinks. That is textbook C2. I would isolate the host and block the destination.

Representative session. Illustrative values, RFC 5737 addresses. Your logs never leave the box.

What it does

Point any MCP client at suricata-mcp and your Suricata IDS/IPS and Zeek NSM logs become tools the agent can call: query alerts, flows, and protocol records; investigate a host or a single alert; and cross-correlate Suricata alerts against Zeek conn/dns/http/ssl by IP pair and time window. Why: a SOC analyst working a single alert normally greps EVE JSON and stitches together flow and protocol context by hand, which does not scale under pressure. How it differs: instead of a dashboard or a one-shot log shipper, it reads your own log files locally and layers detection analytics on top, C2 beaconing, DGA via Shannon entropy, data exfiltration, and lateral movement, so the model does the pivoting. It is read-only by default and speaks stdio, so there is no new network surface, and it drops into Claude Desktop, Claude Code, Codex CLI, OpenClaw, or Hermes.

Capabilities41 tools across Suricata and Zeek

Suricata alerts & flows

6 tools

Query and aggregate EVE alerts by SID, signature, severity, IP, and time; top talkers and bandwidth from flows.

Protocol analysis

6 tools

Inspect DNS, HTTP, TLS (SNI, JA3/JA4), SSH, extracted files, and protocol anomalies from EVE records.

Advanced analytics

4 tools

Detect C2 beaconing, DGA domains via Shannon entropy, data exfiltration, and lateral movement.

Investigation & Zeek NSM

11 tools

Full host and alert investigation, plus query conn/dns/http/ssl/files/ssh/weird from Zeek TSV logs.

Cross-correlation

1 tool

Join Suricata alerts to Zeek metadata by IP pair and time window.

Rules, engine, PCAP & threat intel

13 tools

Search and manage the ruleset, live engine stats, PCAP replay, and MISP/TheHive pivots (mutating tools opt-in).

Full tool reference on GitHub →

Setup

01 · install
npx -y suricata-mcp
02 · configure

Point SURICATA_EVE_LOG at your EVE JSON log; set ZEEK_LOGS_DIR, PCAP_DIR, and MISP/TheHive vars to light up the optional tool groups.

03 · mcp client config
{ "mcpServers": { "suricata": { "command": "npx", "args": ["-y", "suricata-mcp"], "env": { "SURICATA_EVE_LOG": "/var/log/suricata/eve.json", "ZEEK_LOGS_DIR": "/opt/zeek/logs" } } } }

Safety

how it stays safe
Read-only by default: every analysis and query tool works out of the box, while the tools that change a live IDS or shell out stay disabled. Mutating tools (rule writes, ruleset reload, PCAP replay) require both SURICATA_ALLOW_MUTATION=1 in the environment and confirm: true on the call. suricata_create_rule enforces a local SID range and rejects collisions; PCAP filenames are basename-sanitized against option injection. MISP and TheHive calls use manual redirect handling, so a 3xx from a compromised endpoint is refused rather than followed with the API key attached.

More in Security / SOC8 tools

wazuh-mcpRead your Wazuh SIEM from your agent: alerts, agents, and CVEs, read-only. misp-mcpTurn MISP threat intel into answers: events, correlations, and IOC exports on demand. thehive-mcpDrive TheHive incident response from your agent: cases, alerts, tasks, observables. cortex-mcpDetonate an indicator and get one verdict: Cortex analyzers, confirm-gated. mitre-mcpMap alerts to ATT&CK and profile threat groups without leaving your agent. zeek-mcpQuery and correlate Zeek and Suricata NSM logs from your agent. hotwashBuild IR playbooks as flowcharts and run them step by step, agent-drivable. soc-stackOne command stands up a full SOC on Proxmox: Wazuh, TheHive, Cortex, MISP, Zeek, Suricata.