rsfl/splunk-mcp-llm-siemulator-linux

このページは AI により自動翻訳されています。技術的な詳細は原文をご確認ください。原文を見る

20 stars 3 forks 品質 61 トレンド 31MIT

Linux version of Splunk MCP LLM MCP SIEMulator . A Docker lab integrating Splunk SIEM with Ollama LLM via Model Context Protocol for AI-powered security operations.

概要

- (v0.3.12) - Local LLM inference server - - LLM gateway with multi-provider routing, audit logging, and UI - - OpenAI-compatible LLM proxy gateway with custom callbacks - - Model Context Protocol integration with JSON-RPC logging - - LLM evaluation and OWASP LLM Top 10 security testing - - Web interface for AI interactions - - Security information and event management - - Enterprise-grade log collection - - TA-ollama, TA-mcp-jsonrpc, TA-llmgateway with CIM compliance This lab is designed for developing AI/ML security detections based on the MITRE ATLAS framework. - (16 GB RAM + GPU recommended) — tested on Ubuntu 24.04.2 LTS - and - User in docker group: sudo usermod -aG docker $USER 4. (look for "Ansible playbook complete") 6. : http://localhost:8000 (admin / Password1) All TAs are auto-installed on docker compose up via SPLUNK_APPS_URL. - : ollama:server - : Ollama server logs including prompts and responses - : Splunk UF → file monitor on ./logs/ollama.

README

以下は原文 README の抜粋です。原文を見る。

SPLUNK MCP / LLM SIEMulator by Rod Soto - Linux Version (v3.1)

Docker-based AI Security Analysis Lab for Linux

Includes (ALL LOCAL)

Ollama (v0.3.12) - Local LLM inference server
Bifrost - LLM gateway with multi-provider routing, audit logging, and UI
LiteLLM - OpenAI-compatible LLM proxy gateway with custom callbacks
Ollama MCP Server - Model Context Protocol integration with JSON-RPC logging
Promptfoo - LLM evaluation and OWASP LLM Top 10 security testing
OpenWebUI - Web interface for AI interactions
Splunk - Security information and event management
Splunk Universal Forwarder - Enterprise-grade log collection
Technology Add-ons - TA-ollama, TA-mcp-jsonrpc, TA-llmgateway with CIM compliance

MITRE ATLAS Focused Detection Development Lab

This lab is designed for developing AI/ML security detections based on the MITRE ATLAS framework.

Quick Start

Prerequisites

Linux (16 GB RAM + GPU recommended) — tested on Ubuntu 24.04.2 LTS
Docker Engine and Docker Compose
User in docker group: sudo usermod -aG docker $USER

Setup

Clone the repository

git clone 
cd splunk-mcp-llm-siemulator-linux

Set environment variable

export SPLUNK_HEC_TOKEN=f4e45204-7cfa-48b5-bfbe-95cf03dbcad7

Start the lab
```
docker compose up -d
```
Wait for Splunk to fully initialize (look for “Ansible playbook complete”)
```
docker compose logs -f splunk
```

Pull the LLM model (first time only)

docker exec security-range-ollama ollama pull llama3.2

Access Splunk: http://localhost:8000 (admin / Password1)

Architecture Overview

+---------------------------+     +---------------------------+     +-------------------+
|        Ollama LLM         |     |       MCP Server          |     |    Promptfoo      |
|       (port 11435)        |     |      (port 3456)          |     |   (host network)  |
+------------+--------------+     +------------+--------------+     +-------------------+
             |                                 |
             |          |
             |                                 |
+------------+--------------+     +------------+--------------+
|   Bifrost LLM Gateway     |     |  LiteLLM LLM Gateway     |
|       (port 8090)         |     |      (port 4001)         |
|  logs.db → hec_shipper    |     |  custom_callbacks.py     |
+------------+--------------+     +------------+--------------+
             |  HEC                            |  HEC
             v                                 v
+------------------------------------------------------------------+

GitHub で README 全文を見る

インストール

docker exec security-range-ollama ollama pull llama3.2

MCP 初心者？mcpskill.org のガイドから始めましょう →