Unified Detection Engineering Platform — 7,283+ detections across Sigma, Splunk ESCU, Elastic & KQL, powered by MCP
This repository also configures its own agents. See what Threadlinqs-Security-Detection-MCP tells them →
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Cursor rule Cursor
Cursor rule "contentctl-path" from threadlinqs-cmd/Threadlinqs-Security-Detection-MCP, covering contentctl tool configuration (splunk-specific), location, pip install requirements, option 1: force reinstall and option 2: direct pypi url.
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Cursor rule Cursor
The tests: section MUST have valid URLs, NOT placeholder descriptions.
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Cursor rule Cursor
Linux detection testing workflow and lessons learned.
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Cursor rule Cursor
Any pip install command MUST include one of these options.
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Cursor rule Cursor
Self-healing behavior - automatically fix errors and continue.
threadlinqs-cmd/Threadlinqs-Security-Detection-MCP
Cursor rule Cursor
Detection validation tools - location, usage, and multi-SIEM support.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: