Kibana MCP (Ggilligan12)

Kibana MCP服务器

Kibana MCP Demo

Kibana Security的模型上下文协议（MCP）服务器-通过AI助手管理警报、规则和异常。

快速开始

1.克隆和构建

git clone https://github.com/ggilligan12/kibana-mcp.git
cd kibana-mcp
docker build -t kibana-mcp .

2.配置MCP客户端

添加到您的MCP客户端配置（Claude Desktop、Cursor等）：

选项A：使用环境变量（推荐）

首先，设置您的凭据：

export KIBANA_URL="https://your-kibana.example.com:5601"

# Option 1: API Key (recommended)
export KIBANA_API_KEY="your_base64_api_key"

# Option 2: Username/Password
# export KIBANA_USERNAME="your_username"
# export KIBANA_PASSWORD="your_password"

然后添加到MCP配置中：

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "--network", "host", "-e", "KIBANA_URL", "-e", "KIBANA_API_KEY", "kibana-mcp"]
    }
  }
}

对于用户名/密码，请使用：

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "--network", "host", "-e", "KIBANA_URL", "-e", "KIBANA_USERNAME", "-e", "KIBANA_PASSWORD", "kibana-mcp"]
    }
  }
}

选项B：直接凭证（对Claude Desktop来说更容易）

使用API密钥：

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm", "--network", "host",
        "-e", "KIBANA_URL=https://your-kibana.example.com:5601",
        "-e", "KIBANA_API_KEY=your_base64_api_key",
        "kibana-mcp"
      ]
    }
  }
}

使用用户名/密码：

{
  "mcpServers": {
    "kibana-mcp": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm", "--network", "host",
        "-e", "KIBANA_URL=https://your-kibana.example.com:5601",
        "-e", "KIBANA_USERNAME=your_username",
        "-e", "KIBANA_PASSWORD=your_password",
        "kibana-mcp"
      ]
    }
  }
}

*注意：选项B的安全性较低，但对于像Claude Desktop这样的工具来说更方便，因为环境变量更难管理。*

可用工具

• get_alerts -获取安全警报
• tag_alert -向警报添加标签
• adjust_alert_status -更改警报状态（打开/确认/关闭）
• find_rules -搜索检测规则
• get_rule_exceptions -获取规则例外项
• add_rule_exception_items -向规则添加例外
• create_exception_list -创建新的例外列表
• associate_shared_exception_list -将例外列表链接到规则

地方发展

# Install dependencies
uv sync

# Set environment variables (see above)

# Run locally
uv run kibana-mcp

测试环境

# Start local Kibana/Elasticsearch with test data
pip install -r testing/requirements-dev.txt
./testing/quickstart-test-env.sh

# Access at http://localhost:5601 (elastic/elastic)