jmstar85/securityinfrastructure

Developer tools

Эта страница переведена автоматически. Технические детали смотрите в оригинале. Открыть оригинал

22 stars 5 forks Качество 57 Тренд 10

Repository Install

MCP use case for SecOps automation w/ Splunk,CrowdStrike EDR, MISP

Обзор

A comprehensive collection of MCP (Model Context Protocol) server implementations for security platform integrations with enterprise-grade security hardening. This project has undergone comprehensive security hardening to address critical vulnerabilities and implement security best practices: - - SPL injection prevention with query sanitization and dangerous command blocking - Secure XML parsing using defusedxml to prevent XXE attacks - Complete removal of hardcoded credentials from all configuration files - - Enforced TLS 1.2+ with strong cipher suites for all API communications - Comprehensive input validation and sanitization across all servers - Prevention of command execution risks and injection attacks - Error message sanitization to prevent information disclosure - - FQL/SPL injection attack prevention with pattern matching - SSL certificate validation enforcement - Data sanitization for API responses - Secure configuration templates with safe placeholders - Comprehensive .

README

Показан фрагмент оригинального README. Открыть оригинал.

Security Infrastructure MCP Servers

A comprehensive collection of secure MCP (Model Context Protocol) server implementations for security platform integrations with enterprise-grade security hardening.

🛡️ Security-First Design

This project has undergone comprehensive security hardening to address critical vulnerabilities and implement security best practices:

✅ Security Improvements (Latest Update)

🔴 HIGH Severity Fixes:
- SPL injection prevention with query sanitization and dangerous command blocking
- Secure XML parsing using defusedxml to prevent XXE attacks
- Complete removal of hardcoded credentials from all configuration files
🟡 MEDIUM Severity Fixes:
- Enforced TLS 1.2+ with strong cipher suites for all API communications
- Comprehensive input validation and sanitization across all servers
- Prevention of command execution risks and injection attacks
- Error message sanitization to prevent information disclosure
🔵 Additional Security Features:
- FQL/SPL injection attack prevention with pattern matching
- SSL certificate validation enforcement
- Data sanitization for API responses
- Secure configuration templates with safe placeholders
- Comprehensive .gitignore to prevent credential exposure

🔒 Security Documentation

See SECURITY.md for comprehensive security guidelines, configuration best practices, and vulnerability reporting procedures.

🔐 Supported Platforms

Splunk SIEM

Secure SPL Query Execution: Execute Search Processing Language queries with injection prevention
Event Search: Search security events across all indexes with sanitized filtering
Time-based Analysis: Validated time ranges and custom time windows
Asynchronous Job Management: Create and monitor search jobs with secure result retrieval
JSON Result Format: Structured output with sensitive data filtering

CrowdStrike EDR

Secure Detection Search: Query detections using validated FQL (Falcon Query Language)
Detection Details: Retrieve sanitized detection summaries and metadata
OAuth 2.0 Authentication: Secure API access with proper token management
Input Validation: Comprehensive parameter validation and whitelisting
Real-time Threat Data: Access to latest endpoint detection data with security filtering

Microsoft MISP

Event Search: Query MISP events with input sanitization and validation
IOC Attribute Search: Search indicators with XSS and injection prevention
Multi-format Support: Handle various IOC types with content validation
SSL Security: Enforced certificate verification with security warnings
RESTful API Integration: Secure MISP REST API support with error sanitization

🚀 Quick Start

Installation

# 1. Clone the repository
git clone https://github.com/jmstar85/SecurityInfrastructure.git
cd SecurityInfrastructure

# 2. Install secure dependencies

Открыть полный README на GitHub

Установка

This server does not publish a one-line install command.

Open the repository installation guide Новичок в MCP? Начните с руководства на mcpskill.org →

Конфигурация

{
  "mcpServers": {
    "security-infrastructure-splunk": {
      "command": "python",
      "args": ["/FULL/PATH/TO/SecurityInfrastructure/src/splunk_server.py"],
      "env": {
        "SPLUNK_HOST": "REPLACE_WITH_YOUR_SPLUNK_HOST",
        "SPLUNK_TOKEN": "REPLACE_WITH_YOUR_API_TOKEN",
        "SPLUNK_VERIFY_SSL": "true"
      }
    }
  }
}