thomasxm

How to Use the Elasticsearch MCP Server with Claude Code

Data community intermediate

SOURCE https://github.com/thomasxm/CrowdSentinels-AI-MCP

Description

How to Use the Elasticsearch MCP Server with Claude Code skill

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

Repository README

This is the README for thomasxm/CrowdSentinels-AI-MCP, shared by 4 entries in this directory. It describes the repository, not this entry specifically.

How to Use the Elasticsearch MCP Server with Claude Code

✅ Setup Complete!

The Elasticsearch Threat Hunting MCP server is now configured and ready to use!

🔄 How to Load the MCP Server

Option 1: Using /mcp Command (Recommended)

**Type `/mcp` in Code**
**You should see TWO servers:**
- hexstrike-ai (your existing server)
- crowdsentinel (the new server) ← This one!
**Click or select `crowdsentinel`** to activate it
**The server will start automatically!**

🚀 Quick Start (No Elasticsearch Running Yet)

Step 1: Start Elasticsearch with Docker

cd /home/kali/Desktop/elastic_mcp_bundle/crowdsentinel-mcp-server

# Start Elasticsearch
docker-compose -f docker-compose-elasticsearch.yml up -d

# Wait 30 seconds for it to start

# Verify it's running:
curl -k -u elastic:changeme https://localhost:9200

You should see JSON output with Elasticsearch version info.

Step 2: Load the MCP Server in Claude Code

Type /mcp
Select crowdsentinel
Server starts automatically!

Step 3: Try Your First Query

Type in Claude Code:

Discover all assets in my Elasticsearch cluster

The server will:

Connect to Elasticsearch
Scan all indices
Extract metadata (OS types, log sources, fields)
Save to assets/discovered_assets.json
Return the results!

📊 Example Questions to Ask

Asset Discovery

"Discover all assets"
"Show me all Windows event log indices"
"Get metadata for winlogbeat indices"

Threat Hunting

"Check for suspicious attacks in the last 15 minutes"
"Look for brute force attempts in the last hour"
"Find suspicious PowerShell commands"
"Hunt for lateral movement indicators"

Host Investigation

"What processes are running on host WS001?"
"Show me the activity timeline for DC01 server"
"Investigate all activity from user 'admin'"

IoC Hunting

"Search for IP address 192.168.1.100"
"Hunt for file named malicious.exe"
"Track user account 'suspicious_user'"

🛠️ Configuration Location

The MCP configuration is stored at:

/home/kali/.config/Code/User/mcp.json

Current configuration:

Elasticsearch Host: https://localhost:9200
Username: elastic
Password: changeme
SSL Verification: Disabled (for testing)
Write Operations: Disabled (read-only mode)

To Change Elasticsearch Credentials:

Edit `/home/kali/.config/Code/User/mcp.json` and update the `env` section:

"env": {
  "ELASTICSEARCH_HOSTS": "https://your-host:9200",
  "ELASTICSEARCH_USERNAME": "your-username",
  "ELASTICSEARCH_PASSWORD": "your-password",
  "VERIFY_CERTS": "false",
  "DISABLE_HIGH_RISK_OPERATIONS": "true"
}

Then restart Claude Code or reload the MCP server.

🔍 Available Tools (40+ Total)

When you activate the server, you get access to:

Detection Rule Tools (NEW!)

list_detection_rules - Browse 5000+ detection rules with filtering
get_rule_details - Get