Skip to content

MCP SocX

MCP SocX

Tool provides ability to chat with SocXpress to query data and analyze with AI.

Supports returning data for 100+ languages

Usage

Supported platforms: SocXpress, V-Secure, EQUIX

Access ai.socxpress.com and enable corresponding integration tool

Features

No. Feature Tool Query Example
1 Event information analysis analyze_event(event_id: str) analyze event 1528410
2 Compose ticket content based on available information (added event, comments, ticket task) analyze_ticket(ticket_id: str) analyze ticket 42
3 Compose monthly report last_month_executive_summary(organization: str) compose monthly report for onesea
4 Compose ticket report write_ticket_report(ticket_id: str) compose report for ticket 42
5 Check installed software list and warn about policy-violating applications check_PUA_org(organization: str) check suspicious software for onesea

Technical Details of Tools

Below is the list of MCP-SocX (mcp-tool) tools available, and sample query instructions

analyze_event(event_id: str):

Query database to get event information (rule_description, created_at, system_message, detail_json) for corresponding events.id, then return analysis prompt with raw data.

  • Purpose: Analyze event
  • Query example:

analyze event 282732

analyze event https://v-secure.io/admin/events/1528410

analyze event 282732

analyze_ticket(ticket_id: str):

Query tickets, ticket_comments, ticket_events (combined with event_payloads) and ticket_tasks, then return ticket analysis prompt with raw data. Used for SOC Analyst.

  • Purpose: Generate summary & recommendations based on ticket content and related events.
  • Query example:

analyze ticket 42

analyze ticket https://v-secure.io/admin/events/42

analyze ticket 42

write_ticket_report(ticket_id: str):

Get ticket information, comments, related events, tasks and return a report generation prompt (suitable for stakeholders) with raw data. Used for SOC Manager or SOC Tier 2, 3 to send reports to customers

  • Purpose: Create detailed table/report ticket for leadership or customers.
  • Query example: write_ticket_report("42")

compose report for ticket 42

write ticket report for ticket 42

last_month_executive_summary(organization: str):

Find list of sensors (manager, alias) related to organization, query events and tickets in last 30 days, count triaged alerts and ticket status, then return executive report prompt with aggregated data.

  • Purpose: Generate 30-day executive summary for an organization.
  • Query example:

compose monthly report for equix

write executive report for onesea

last_month_executive_summary_vessel(vessel: str):

Similar to above function but by vessel (ship alias).

  • Purpose: 30-day executive report for a ship/vessel entity.
  • Query example: last_month_executive_summary_vessel("VesselName")

check_PUA_org(organization: str):

Get list of installed software (agent_packages) for organization's managers, then return prompt requesting PUA (Potential Unwanted Application) analysis with software list.

  • Purpose: Analyze suspicious PUA software based on actual application list on endpoints.
  • Query example:

check suspicious software for onesea
analyze PUA for onesea

TO-DO List

  • IOC hunting: hunt for IOCs in the system
  • CISO critical incidents summary
  • organization_security_posture