Overview

Prime Architect supports Model Context Protocol (MCP), which allows you to access Prime Architect capabilities from your own AI environment via the MCP Server. By generating an MCP token in Prime Architect, you can connect your AI agents to the MCP Server and use Prime Architect tools without opening the Prime Architect interface.

MCP Token Generation

To generate an MCP token in Prime Architect, follow the steps below.

Go to CI/CD in the upper-right corner and select MCP Tokens.
Select Add New MCP Token.
In the modal window, provide the following information:
- Name of the MCP token
- Expiration date
- IPs that are authorized to make requests to the MCP Server (optional)
Select Generate.
When the MCP Token Generated modal appears, copy the generated token and save it in a safe place. For security reasons, you won't be able to view it again once you close this modal. The token is stored in an encrypted format.

MCP Server Connection

After generating an MCP token, you can connect your AI agent to the MCP Server. The exact connection steps depend on the AI agent you use (e.g. Cursor, Claude Desktop, Claude CLI).

You'll typically need to provide:

Name – any name you want to use to identify this MCP Server connection in your AI environment
URL – the MCP Server URL:
- https://pubmcps.socprime.com/mcp
Authentication type – Bearer Token
Token – the MCP token you generated above

Note: We currently support only Bearer Token authentication. OAuth, OpenID Connect (OIDC) and other authentication methods are currently not supported.

Example: Connecting Cursor to MCP Server

Open Cursor, click the + icon and select MCP.
Select Manage.
Select Add Custom MCP.

In the dialog, enter:

{
    "mcpServers": {
      "public-mcp-server": {
        "url": "https://pubmcps.socprime.com/mcp",
        "headers": {
          "Authorization": "Bearer <MCP TOKEN>"
        }
      }
    }
  }

Replace <MCP TOKEN> with your actual token.

Save and close the dialog.
Click the + icon again and select MCP. You can see public-mcp-server now listed by name. Make sure the toggle next to public-mcp-server is switched on, so the agent can use its tools.
Select Manage to see the full list of available tools.

MCP Tools

Here you can find descriptions of the MCP tools your agent can call once connected to the MCP Server, along with examples of requests you can write to the agent and the responses you can expect to get back.

generate_short_summary

What it does:

A concise summary of the detection logic in human language. You can provide a threat report or a detection rule and receive a brief overview with key insights.

Example:

Here's a Sigma rule. Give me a short summary.

Response:

You get a brief overview of what the rule detects and why it matters.

generate_full_summary

What it does:

A detailed explanation of the detection logic in human language. You can provide a threat report or a detection rule and receive an in-depth breakdown with all relevant details.

Example:

Here's a Sigma rule. Give me a full summary.

Response:

You get an in-depth summary that covers all relevant details and fine points involved in the detection logic.

generate_decision_tree

What it does:

Explains how a detection logic works step by step, with all the embeddings, branches, and other intricate logic. Requires specifying the SIEM type.

Example:

Build a decision tree for this Sentinel rule: what to check first, what next.

Response:

You get a step-by-step breakdown of a detection logic.

generate_attack_flow

What it does:

From a threat report, builds a structured Attack Flow based on the MITRE ATT&CK framework, combining MITRE ATT&CK techniques, attack diagram, and attack matrix. Visualizes adversary activity so defenders can move from tracking individual behaviors to tracking the full sequence of behaviors an adversary uses to achieve their goals.

Example:

Here's a threat report. Build an attack flow: techniques, diagram, and attack matrix.

Response:

You get:

A list of MITRE ATT&CK techniques
An attack diagram showing the sequence of behaviors
An attack matrix grouped by tactic

generate_behavior_rule

What it does:

Generates Sigma behavior rules from a threat report, one by one as each is ready.

Example:

From this threat report, generate Sigma detection rules. Show each rule as soon as it's ready.

Response:

Rules appear gradually (Rule 1, Rule 2, …) without waiting for the full batch.

deep_threat_research

What it does:

Runs deep, multi-stage research on a threat report to turn it into comprehensive threat intelligence, including:

Summary – A concise overview of the analyzed threat, including key information extracted from the threat report and the main findings generated during the analysis.
Investigation – Recommended actions and guidance for investigating the threat.
Mitigation – Recommended actions for reducing the impact of the threat based on security best practices.
Response – Recommended response actions to help security teams address the threat, minimize risks, and take appropriate steps after identifying malicious activity.
Actors – Threat actors associated with the analyzed threat.
Mitre ATT&CK Techniques – MITRE ATT&CK techniques associated with the threat, showing the techniques used by adversaries during the analyzed activity.
Attack Flow – A visual representation of the adversary's attack sequence based on the MITRE ATT&CK framework, combining MITRE ATT&CK techniques, attack diagram, and attack matrix.
Behavior rules – Sigma behavior rules from a threat report.
Simulation – Simulations of malicious activity associated with the threat.

Example:

Run deep threat research on this threat report. Show results stage by stage.

Response:

You get the output structured stage by stage from initial summary to final simulation. For the Attack Flow stage, expect both the attack diagram and the attack matrix.

translate

What it does:

Translates a rule/query from one SIEM format to another.

Example:

Translate this Sigma rule to a Splunk query.

Or:

Convert this Sentinel KQL to Elastic.

Response:

You get the rule/query in the target format with the same detection logic preserved.

optimize_query

What it does:

Recommendations to make a query/rule more efficient. Requires specifying the SIEM type.

Example:

Here's my Splunk query. How can I optimize it?

Or:

Optimize this Sigma for better performance.

Response:

You get concrete improvement suggestions.

Supported Platforms

Behavior Rule/Query Generation

You can generate detection rules and queries for the following platforms:

Anomali Security Analytics
Apache Kafka ksqlDB
ArcSight
AWS Athena
AWS OpenSearch
Crowdstrike Endpoint Security
CSharp Regex
Datadog
Devo
DNIF
ElastAlert
Elastic Stack
Falco
Falcon LogScale
FireEye
FortiSIEM
Google SecOps
Graylog
HawkSearch
Hunters
IBM QRadar
Lacework
Level Blue USM
LimaCharlie
Logiq
Logpoint
LogRhythm
Microsoft Defender for Endpoint
Microsoft Sentinel
NVISO EE-Outliers
Palo Alto Cortex XDR
Palo Alto Cortex XSIAM
PowerShell
Qualys
Regex Grep
Roota
RSA NetWitness
Securonix
SentinelOne
Snowflake
Splunk
SQL
SQLite
STIX
StreamAlert
Sumo Logic
Sysmon
UberAgent ESA
VMware Carbon Black
Logsign Unified SecOps
Suricata
Tanium
Sophos EDR
Logz.io
Trend Micro XDR
Exabeam

Short Summary, Full Summary, Decision Tree, and Query Optimization

You can optimize queries, generate short summaries, full summaries, and decision trees for the following platforms:

Anomali Security Analytics
Apache Kafka ksqlDB
ArcSight
AWS Athena
AWS OpenSearch
Crowdstrike Endpoint Security
CSharp Regex
Datadog
Devo
DNIF
ElastAlert
Elastic Stack
Falco
Falcon LogScale
FireEye
FortiSIEM
Google SecOps
Graylog
HawkSearch
Hunters
IBM QRadar
Lacework
LimaCharlie
Logiq
Logpoint
LogRhythm
Microsoft Defender for Endpoint
Microsoft Sentinel
NVISO EE-Outliers
Palo Alto Cortex XDR
Palo Alto Cortex XSIAM
PowerShell
Qualys
Regex Grep
Roota
RSA NetWitness
Securonix
SentinelOne
Snowflake
Splunk
SQL
SQLite
STIX
StreamAlert
Sumo Logic
Sysmon
UberAgent ESA
VMware Carbon Black