An MCP server wrapping Hayabusa for Windows EVTX log scanning, extended with a detection engineering knowledge base with browsable Sigma rules and ATT&CK technique mappings that let Claude query detection coverage directly.
2 files for Claude Code: MCP-Detection-Knowledge-Bases, MCP-Detection-Knowledge-Bases CLAUDE.md — 4,774 tokens loaded in every session.
CLAUDE.md A 4,774 tok .claude/settings.json A — These files are chiomao23/MCP-Detection-Knowledge-Bases's own configuration — they tell Claude Code how to work on this repository, so they are not mods to install elsewhere. Copy one as a starting point and replace the parts that are about this project.