Overview

Prime Architect supports Model Context Protocol (MCP), which allows you to access Prime Architect capabilities from your own AI environment via the MCP Server. By generating an MCP token in Prime Architect, you can connect your AI agents to the MCP Server and use Prime Architect tools without opening the Prime Architect interface.

MCP Token Generation

To generate an MCP token, follow the steps below.

Go to Account icon > Platform Settings > MCP Tokens.
Select Add New MCP Token.
In the modal window, provide the following information:
- Name of the MCP token
- Expiration date
- IPs that are authorized to make requests to the MCP Server (optional)
Select Generate.
When the MCP Token Generated modal appears, copy the generated token and save it in a safe place. For security reasons, you won't be able to view it again once you close this modal. The token is stored in an encrypted format.

Manage MCP Tokens

On the MCP Tokens page, you can edit or delete the tokens you created.

Go to Account icon > Platform Settings > MCP Tokens.
Click the three-dot icon on the right of the needed token name and select Edit or Delete.
In the modal, select Save Changes or Delete, depending on the action you’re performing.

Note: When editing an MCP token, you can make changes only to the Allowed APIs field.

MCP Server Connection

After generating an MCP token, you can connect your AI agent to the MCP Server. The exact connection steps depend on the AI agent you use (e.g. Cursor, Claude Desktop, Claude CLI).

You'll typically need to provide:

Name – any name you want to use to identify this MCP Server connection in your AI environment
URL – the MCP Server URL:
- https://pubmcps.socprime.com/mcp
Authentication type – Bearer Token
Token – the MCP token you generated above

Note: We currently support only Bearer Token authentication. OAuth, OpenID Connect (OIDC) and other authentication methods are currently not supported.

Example: Connecting Cursor to MCP Server

Open Cursor, click the + icon and select MCP.
Select Manage.
Select Add Custom MCP.

In the dialog, enter:

{
    "mcpServers": {
      "public-mcp-server": {
        "url": "https://pubmcps.socprime.com/mcp",
        "headers": {
          "Authorization": "Bearer <MCP TOKEN>"
        }
      }
    }
  }

Replace <MCP TOKEN> with your actual token.

Save and close the dialog.
Click the + icon again and select MCP. You can see public-mcp-server now listed by name. Make sure the toggle next to public-mcp-server is switched on, so the agent can use its tools.
Select Manage to see the full list of available tools.

MCP Tools

Here you can find descriptions of the MCP tools your agent can call once connected to the MCP Server, along with examples of requests you can write to the agent and the responses you can expect to get back.

generate_short_summary

What it does:

Explains detection logic in plain language. Provide a detection rule or a threat report and get a brief overview with key insights: what the rule detects and why it matters.

Example request:

"Here's a Sigma rule. Give me a short summary."

Response:

You get a brief overview of what the rule detects and why it matters.

generate_full_summary

What it does:

You can provide a threat report or a detection rule and receive an in-depth breakdown with all relevant details. Gives a detailed plain-language explanation of detection logic. Provide a detection rule or a threat report and get an in-depth breakdown covering all relevant details and fine points.

Example request:

"Here's a Sigma rule. Give me a full summary."

Response:

You get an in-depth summary that covers all relevant details and fine points involved in the detection logic.

generate_decision_tree

What it does:

Shows how detection logic works step by step, including branches, nested conditions, and other complex logic, so you can see what is checked first and what follows. Specify the SIEM type in your request.

Example request:

"Build a decision tree for this Sentinel rule: what to check first, what next."

Response:

You get a step-by-step breakdown of a detection logic.

generate_attack_flow

What it does:

From a threat report, builds a structured Attack Flow based on the MITRE ATT&CK framework, and returns a list of MITRE ATT&CK techniques, an attack diagram showing the sequence of adversary behaviors, and an attack matrix grouped by tactic. Visualizes adversary activity so defenders can move from tracking individual behaviors to tracking the full sequence of behaviors an adversary uses to achieve their goals.

Example request:

"Here's a threat report. Build an attack flow: techniques, diagram, and attack matrix."

Response:

You get:

A list of MITRE ATT&CK techniques
An attack diagram showing the sequence of behaviors
An attack matrix grouped by tactic

generate_behavior_rule

What it does:

Generates Sigma behavior rules from a threat report, one by one as each is ready.

Example request:

"From this threat report, generate Sigma detection rules. Show each rule as soon as it's ready."

Response:

Rules appear gradually (Rule 1, Rule 2, …) without waiting for the full batch.

deep_threat_research

What it does:

Runs deep, multi-stage research on a threat report to turn it into comprehensive threat intelligence, including:

Summary – A concise overview of the analyzed threat, including key information extracted from the threat report and the main findings generated during the analysis.
Investigation – Recommended actions and guidance for investigating the threat.
Mitigation – Recommended actions for reducing the impact of the threat based on security best practices.
Response – Recommended response actions to help security teams address the threat, minimize risks, and take appropriate steps after identifying malicious activity.
Actors – Threat actors associated with the analyzed threat.
MITRE ATT&CK Techniques – MITRE ATT&CK techniques associated with the threat, showing the techniques used by adversaries during the analyzed activity.
Attack Flow – A visual representation of the adversary's attack sequence based on the MITRE ATT&CK framework, combining MITRE ATT&CK techniques, attack diagram, and attack matrix.
Behavior rules – Sigma behavior rules from a threat report.
Cyber Kill Chain – Which of the seven stages of the Lockheed Martin Cyber Kill Chain the threat covers (Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives), helping you understand how the threat progresses during an intrusion and spot potential detection opportunities.
Pyramid of Pain – Threat indicators extracted from the report, grouped into the six tiers of the Pyramid of Pain framework: Hash Values, IP Addresses, Domain Names, Network/Host Artifacts, Tools, and TTPs. Tiers are ranked from indicators that are easy for adversaries to change (hash values) to those that take significant effort to modify (TTPs).
Diamond Model – The four core elements of the threat based on the Diamond Model of Intrusion Analysis: Adversary (the threat actor or organization), Capability (tools, malware, and techniques), Victim (targeted entities or organizations), and Infrastructure (systems, resources, and services used in the activity). Shows the entities extracted for each element, the relationships between them, and meta-features such as Phase, Result, Direction, Methodology, and Confidence.
Simulation – Simulations of malicious activity associated with the threat.

Example request:

"Run deep threat research on this threat report. Show results stage by stage."

Response:

You get the output structured stage by stage from initial summary to final simulation. For the Attack Flow stage, expect both the attack diagram and the attack matrix.

translate

What it does:

Converts a rule or query from one SIEM format to another, for example Sigma to Splunk or Sentinel KQL to Elastic, while preserving the original detection logic.

Example request:

"Translate this Sigma rule to a Splunk query."

Or:

"Convert this Sentinel KQL to Elastic."

Response:

You get the rule/query in the target format with the same detection logic preserved.

optimize_query

What it does:

Reviews a rule or query, such as a Splunk query or a Sigma rule, and gives concrete suggestions for making it more efficient. Specify the SIEM type in your request.

Example request:

"Here's my Splunk query. How can I optimize it?"

Or:

"Optimize this Sigma for better performance."

Response:

You get concrete improvement suggestions.

Supported Platforms

Behavior Rule/Query Generation

You can generate detection rules and queries for the following platforms:

Anomali Security Analytics
Apache Kafka ksqlDB
ArcSight
AWS Athena
AWS OpenSearch
Coralogix
Cribl
Crowdstrike Endpoint Security
CrowdStrike Next-Gen SIEM
CSharp Regex
Datadog
Devo
DNIF
ElastAlert
Elastic Stack
Falco
FireEye
FortiSIEM
Google SecOps
Graylog
HawkSearch
Hunters
IBM QRadar
Lacework
Level Blue USM
LimaCharlie
Logiq
Logpoint
LogRhythm
Microsoft Defender for Endpoint
Microsoft Sentinel
NVISO EE-Outliers
Palo Alto Cortex XDR
Palo Alto Cortex XSIAM
PowerShell
Qualys
Regex Grep
Roota
RSA NetWitness
Securonix
Semgrep
SentinelOne
Snowflake
Splunk
SQL
SQLite
STIX
StreamAlert
Sumo Logic
Sysmon
UberAgent ESA
VMware Carbon Black
Logsign Unified SecOps
Suricata
Tanium
Sophos EDR
Logz.io
Trend Micro XDR
Exabeam

Short Summary, Full Summary, Decision Tree, and Query Optimization

You can optimize queries, generate short summaries, full summaries, and decision trees for the following platforms:

Anomali Security Analytics
Apache Kafka ksqlDB
ArcSight
AWS Athena
AWS OpenSearch
Crowdstrike Endpoint Security
CSharp Regex
Datadog
Devo
DNIF
ElastAlert
Elastic Stack
Falco
Falcon LogScale
FireEye
FortiSIEM
Google SecOps
Graylog
HawkSearch
Hunters
IBM QRadar
Lacework
LimaCharlie
Logiq
Logpoint
LogRhythm
Microsoft Defender for Endpoint
Microsoft Sentinel
NVISO EE-Outliers
Palo Alto Cortex XDR
Palo Alto Cortex XSIAM
PowerShell
Qualys
Regex Grep
Roota
RSA NetWitness
Securonix
SentinelOne
Snowflake
Splunk
SQL
SQLite
STIX
StreamAlert
Sumo Logic
Sysmon
UberAgent ESA
VMware Carbon Black

Skills Tools

Agentic Skill is a set of specialized instructions for a specific security task. Instead of explaining a complex workflow in every prompt, you give the agent a skill that already contains the exact steps, requirements and logic needed to complete the task.

Through MCP Server, your AI agent can access the library of Agentic Skills in SOC Prime, which allows discovering, inspecting and executing specialized security workflows directly from your AI environment.

What can you do with Agentic Skills?

With the skills tools, your agent can:

Discover skills by browsing the catalogue, which is organized by the NIST Cybersecurity Framework functions, or by searching by name, description or author.
Inspect a skill before using it by viewing its metadata and full instructions.
Execute a skill in one of two ways:
- Take the Agentic Skill and use it yourself. You retrieve the skill’s full instructions and metadata, and use them in your own compatible environment.
- Run it in Prime Architect. SOC Prime runs the skill on its side, using the capabilities available in Prime Architect, and returns the result to your agent.

Your AI agent can use a specific set of tools. Below is a breakdown of what these tools do and how you can trigger them.

Discovery Tools

These tools help your agent find the right skill for your task.

list_skills

What it does:

Browses the SOC Prime skills library and returns 20 skills by default. For each skill, it returns:

Skill ID – Unique identifier assigned to the skill
Name – Name of the skill
Description – A brief summary of the skill's purpose
Author – Who created or published the skill
Compatibility – Information about the environments, agents, and tools the skill is compatible with (e.g., Prime Architect, Claude, Codex)
Category – The NIST Cybersecurity Framework category the skill belongs to (Govern, Identify, Protect, Detect, Respond, Recover)
Security Score – Reflects the outcome of the skill's security review
SOC Prime verification status – Indicates whether the skill has been reviewed and verified by the SOC Prime team
Number of installations – Total installs across all users

You can filter by category, sort by newest, recently updated, most installed, or release date, and change the number of results.

Instructions are not included, so you can scan the list quickly and pick a skill to look at in detail.

When to use it:

When you want to see what new or trending skills are available.

Example requests:

Basic: “Show me the Skills available in SOC Prime.”
Category: “Show me the skills in the Detect category.”
Order: “Show me the most recently published skills.” You can ask for newest, recently updated, most installed or release date.
Number of results: “Return 40 Skills instead of 20.”
More results: “Show me the next page.”

Response:

You get one page of library skills with the details above.

search_skills

What it does:

Searches the library for skills whose ID, name, description, or author matches your search term, optionally within a category. Returns the matching skills with the following details:

Skill ID – Unique identifier assigned to the skill
Name – Name of the skill
Description – A brief summary of the skill's purpose
Author – Who created or published the skill
Compatibility – Information about the environments, agents, and tools the skill is compatible with (e.g., Prime Architect, Claude, Codex)
Category – The NIST Cybersecurity Framework category the skill belongs to (Govern, Identify, Protect, Detect, Respond, Recover)
Security Score – Reflects the outcome of the skill's security review
SOC Prime verification status – Indicates whether the skill has been reviewed and verified by the SOC Prime team
Number of installations – Total installs across all users

Instructions are not included.

When to use it:

When you have a specific topic, task or author in mind and don’t want to browse the whole library.

Example requests:

By topic: “Find skills related to ransomware.”
By task: “Find skills that generate Sigma rules.”
By author: “Find skills by SOC Prime.”
With a category: “Find skills related to phishing in the Respond category.”

Response:

You get the library skills that match your search with the details above.

list_user_skills

What it does:

Browses your personal skills (your created skills) and returns 20 skills by default. For each skill, it returns:

Skill ID – Unique identifier assigned to the skill
Name – Name of the skill
Short description – A brief summary of the skill's purpose
Author – Who created the skill
Category – The NIST Cybersecurity Framework function the skill belongs to
Installation status – Whether the skill is installed in your Prime Architect, and when it was installed
Created – When the skill was created
Updated – When the skill was last changed

You can sort by newest or recently updated and change the number of results. Instructions are not included.

When to use it:

When you want to see your personal collection.

Example requests:

Basic: “Show me my personal skills”
Order: “Show me my most recently updated skills.”
Number of results: “Return 40 of my skills instead of 20.”
More results: “Show me the next page of my skills.”

Response:

You get one page of your personal skills with the details above.

search_user_skills

What it does:

Searches your personal skills for skills whose ID, name, or description matches your search term. Returns the matching skills with the following details:

Skill ID – Unique identifier assigned to the skill
Name – Name of the skill
Short description – A brief summary of the skill's purpose
Author – Who created the skill
Category – The NIST Cybersecurity Framework function the skill belongs to
Installation status – Whether the skill is installed in your Prime Architect, and when it was installed
Created – When the skill was created
Updated – When the skill was last changed

Instructions are not included.

When to use it:

To find a specific workflow you created earlier.

Example Request:

"Search my personal skills for phishing."

Response:

You get your personal skills that match the search.

Inspection Tools

Use these tools to read a skill to ensure it is correct before running it.

get_skill

What it does:

Opens one library skill and returns its full metadata and instructions:

Short description – A brief summary of the skill's purpose
Flow diagram – A visual showing the expected input, process, and output flow
When to Use – Scenarios the skill fits, and cases where it doesn't
Prerequisites – What needs to be in place or provided before running the skill
How it Works – The steps the agent follows to produce the skill's output
Example – A sample command or prompt showing the skill in action
Security Score – Reflects the outcome of the skill's security review
Number of installations – Total installs across all users
Release date – When the skill was published or last updated
Author – Who created or published the skill
SOC Prime verification status – Indicates whether the skill has been reviewed and verified by the SOC Prime team
Category – The NIST Cybersecurity Framework category the skill belongs to (Govern, Identify, Protect, Detect, Respond, Recover)
Compatibility – Information about the environments, agents, and tools the skill is compatible with (e.g., Prime Architect, Claude, Codex)
Security Checks – The results of automated security checks run against the skill
Instructions – Actual skill instructions

When to use it:

To review a skill before running it, or to take the skill into your own AI environment, where you can apply it to your tasks or save it as a reusable skill.

Example Request:

“Get the full details of sigma-rule-analysis skill.”

get_user_skill

What it does:

Opens one personal skill and returns its full metadata and instructions:

Skill ID – Unique identifier assigned to the skill
Name – Name of the skill
Short description – A brief summary of the skill's purpose
Author – Who created the skill
Category – The NIST Cybersecurity Framework function the skill belongs to
Installation status – Whether the skill is installed in your Prime Architect, and when it was installed
Created – When the skill was created
Updated – When the skill was last changed
Instructions – Actual skill instructions

When to use it:

To review a personal skill before running it, or to take the skill into your own AI environment, where you can apply it to your tasks or save it as a reusable skill.

Example Request:

"Show me the instructions for my sigma-rule-repair skill."

Execution Tool

run_architect

What it does:

Sends your request together with the selected skill to Prime Architect, which starts working on it right away. SOC Prime runs the skill on its side, using the capabilities available in Prime Architect, and returns the skill’s output to your agent.

When to use it:

When you want Prime Architect to do the work with a specific skill.

Example Request:

“Run the sigma-rule-analysis skill in Prime Architect on this Sigma rule”

Response:

You get the output of the skill for your rule.

Using a Skill in Your Own Environment

Retrieve the skill. Ask your agent to get the skill’s full instructions with get_skill for library skill or get_user_skill for your personal skill.
Check it. Check skill metadata and full instructions.
Use it. Apply the skill to your tasks in your AI environment, or save them in your environment as a reusable skill and use it in later requests.