AlphaSOC MCP Server
New Release
You can connect an AI agent directly to your AlphaSOC workspace. Our MCP server exposes OCSF findings, threat intelligence, and the data lake as tools an agent can call, so questions like "what fired last night" or "have we ever seen this domain" are answered in conversation rather than in the console.
Claude, opencode, and any other client that supports remote MCP servers can connect. Access follows your existing workspace membership, roles, and licenses, so an agent reads exactly what you can read and nothing else.
What an Agent Can Ask
- Rank findings without writing a query: Break findings down by detection, MITRE ATT&CK technique, data origin, data scope, or observable. Single dimension questions read pre-aggregated summaries rather than opening every finding, so "what is firing most this week" costs one call.
- Search findings in KQL: Filter on finding level fields when the summary is not specific enough. The query dialect and dataset guides are tool calls of their own, so the agent writes valid queries instead of guessing at syntax.
- Read raw records from the data lake: Search Evidences, Activity, and Events by hostname, address, hash, or user to answer "have we ever seen this" straight from the archive index, without composing a full query first.
- Look up threat intelligence on an indicator: Score an address, domain, or hash against AlphaSOC's curated indicators and return the flags, prevalence, and whois context behind that score.