Skip to content

Getting started with the Sekoia MCP Server

This tutorial walks you through a first investigation with the Sekoia plugins in Claude Code. By the end, you will have investigated an alert end to end in plain language: gathered everything on the alert, checked its indicators against Sekoia threat intelligence, followed the user in your events and summarised the case.

Early Access

This feature is currently in Early Access and is only available for Beta testers. Sekoia plans to roll out this functionality to all environments soon.

Scenario

A SentinelOne alert, AL2h7Kq9pXmW, was raised on the laptop laptop-a1b2c3 of the user alex.martin. You want to know what the EDR flagged, who is impacted, whether the indicators are known to Sekoia and what the user did afterwards. You will do all of it from your terminal.

The alert, host and user in this tutorial are fictitious. To follow along, pick an alert from your own community and use its ID in Step 2. The later prompts refer to "this alert", so they work on yours as written. The wording of the prompts is also an example: Claude Code picks the skill that matches your question, and the skill calls the tools.

Step 1: Install the plugins

Follow Install the Sekoia plugins in Claude Code and install both sekoia-soc and sekoia-cti. Type /mcp to confirm that the sekoia server is connected and lists its tools.

For this tutorial, your API key needs the View alerts, View cases, View events, View Rules Catalog, View intelligence, View query builder data sources and Execute query permissions. If a step is skipped, the skill names the permission that is missing.

Step 2: Get everything on the alert

Get everything on alert AL2h7Kq9pXmW.

The alert-details skill gathers the full record of the alert and presents it as facts, without a verdict:

  • The alert: title (for example SentinelOne EDR Threat Detected (Malicious)), status, urgency, detection type, first and last seen.
  • The rule: what it matches and whether it is a behavioral detection, a pass-through of the EDR verdict or a threat intelligence match, with its documented false positives.
  • The entities from the events: host laptop-a1b2c3, user alex.martin, a zero-byte .lnk file written by onenote.exe in a temporary folder, and the mitigation status of the agent.
  • The threats with their Sekoia intelligence context, the ATT&CK techniques and the linked case.

It ends with the next pivots: the linked case, a hunt on the host or the user.

For more ways to ask about an alert, see Get everything on an alert.

Step 3: Check the indicators against threat intelligence

Are the file hash and the external IP from this alert known to Sekoia CTI? If they are, which threat are they linked to?

The query skill looks up the observables, then profiles the threat they indicate. It answers in a few sentences with the object IDs, the confidence, the dates and the Sekoia source of the evidence, and says plainly when a value is not in Sekoia intelligence.

Pivot further

Ask which malware and tools the threat uses, or which reports cover it, to build a short brief without leaving the session.

For more on indicator lookups, see Enrich an indicator.

Step 4: Follow the user in your events

Find the last successful login of the impacted user in the last 30 days, then show the activity on the host over the last 24 hours, grouped by event category.

The sol-hunt skill writes two bounded SOL queries, shows them, runs them with run_sol_query and reads the results back in words:

events
| where timestamp between (ago(30d) .. now())
| where user.name == 'alex.martin' and event.category == 'authentication'
| where action.outcome == 'success'
| select timestamp, host.name, source.ip
| order by timestamp desc
| limit 1

events
| where timestamp between (ago(24h) .. now())
| where host.name == 'laptop-a1b2c3'
| aggregate count() by event.category
| order by count desc
| limit 20

For example: a successful login from the internal network, followed by ordinary process creations and DNS resolutions. Each count comes with its time window; an empty result reads "no rows for that filter in that window", never "it never happened".

For more questions you can ask about your events, see Query your data in plain language.

Step 5: Summarise the case

Summarise the case linked to this alert as a timeline and a five-line narrative.

The case-summary skill returns the case status and priority, a timeline of its alerts in chronological order with the host, user and rule of each, the entities involved and a five-line narrative of facts. Its assessment, if any, is labelled as such.

For more on case summaries, see Summarise a case.

Outcome

In five prompts you have:

  • Gathered the alert, its rule, its events and its entities
  • Checked the indicators against Sekoia threat intelligence
  • Reconstructed the user's activity after the alert
  • Produced a case summary you can share with the next shift

You can now decide on the alert in the platform with the full context, or paste the summary into the case.

What to try next