Expose any service in the Mindflow catalog as a governed MCP server, even when the vendor doesn’t ship one. Every call from Claude, ChatGPT, Cursor or your own agents goes through one gateway, with scoped access, approvals and a complete audit trail.

This automation runs a complex query against Log Analytics to retrieve Azure Sentinel alerts or other security logs, converts the returned data into JSON, and uses it to update security alerts with additional information. It replaces a manual search-and-update process with a consistent enrichment workflow.

This automation receives notable security alerts, locates the corresponding notable event through a controlled search process, and updates its status with a comment in the security platform. It also monitors search completion and emails an administrator when the search fails.

This automation investigates the actions performed during a single Azure Active Directory session after a suspicious event. It retrieves the relevant audit history, organizes key activity details into a Workbook, and shares the completed report back with the investigating team.

This automation enriches a medium-severity security alert by investigating indicators, alerts, detects, and device telemetry across the environment. It delivers a concise triage summary showing how widely a hash has executed, details for the primary host, and a recommendation on whether the activity is a widespread false positive or an isolated anomaly.

This automation analyzes reported phishing emails by checking sender reputation, scanning embedded URLs, evaluating attachments, and using an AI agent to determine whether security involvement is required. It consolidates the findings into a report and posts the assessment to a Slack channel for team awareness and action.

This automation continuously reviews scheduled password-manager login events and investigates IP addresses that do not match known user or device activity. It produces contextualized security notifications for suspicious events so the security team can follow up on potential account compromise.

This automation identifies active IAM access keys that have not been used for more than 90 days, gathers the related user and issue evidence, and creates a trackable incident for review. It gives the responder a clear choice to deactivate the key or ignore the issue, then records the decision and closes the incident.

This automation investigates CrowdStrike detections, applies conditional containment and enrichment actions, and records the findings in ServiceNow. It reduces the need for analysts to manually collect evidence, search file hashes, manage endpoint containment, and update incident records.

This automation investigates medium-severity security alerts by interrogating affected hosts with read-only endpoint evidence checks. It produces a concise live investigation summary with findings and a recommendation on whether the alert indicates active compromise, benign activity, or requires Tier 3 escalation.

This automation analyzes forwarded emails for phishing indicators by extracting sender, recipient, domain, and URLs, checking their reputations, and assessing the collected evidence. It produces a structured security report for the team and can send a warning to the recipient when the team approves that action.

This automation investigates brute-force security alerts by gathering the affected user's identity, recent sign-in activity, related accounts, and suspicious IP context before presenting approved remediation options. It applies the selected response, records the actions and timestamps, updates the alert conversation, and creates an auditable incident ticket.

This automation analyzes suspicious emails across their headers, sender, attachments, URLs, email addresses, and domains, then consolidates the findings into a Jira case. It replaces fragmented investigation steps with a structured triage record containing a verdict and supporting evidence.

This automation turns incoming security alerts into tracked investigation and response workflows. It creates a Jira record, notifies the responsible user in Teams with response options, runs selected Defender scans, gathers investigation evidence, and can escalate or update the incident based on the user's decision.

This automation creates a GitHub issue documenting a suspected failure in SIEM alerting, including the alert problem, expected and actual behavior, and relevant diagnostic details. It turns a recurring security-monitoring concern into a structured issue for investigation and resolution.

This automation analyzes a submitted phishing email by extracting sender addresses, URLs, and attachments, then checking them against reputation and threat-analysis services. It consolidates the findings into a formatted report and emails the results to the requester.

This automation reviews user device IP history, checks multiple IP addresses for malicious activity, and evaluates whether location changes are plausible. It delivers investigation details to a team channel and supports device locking when suspicious activity meets the workflow's containment conditions.

This automation monitors downloaded files reported by endpoint security, retrieves the relevant user, device, and file details, and checks the file against multiple malware intelligence sources. It delivers a curated security alert to the SOC with related case information and analyst-approved remediation actions.

This automation evaluates incoming security incidents, checks for duplicate or related records, and performs structured triage with optional enrichment. It creates actionable incident tickets, remediation tasks, and broader incident groupings so analysts can work from a consistent, correlated case record.

This automation continuously analyzes Drive download events to identify potentially sensitive documents, filter out system and non-sensitive activity, and correlate repeated downloads by the same user. It alerts the security team with investigation and remediation options, creates an activity report when requested, and can sign the user out after human approval.

This automation receives PagerDuty incident webhooks, determines the incident type, and enriches relevant incidents with incident, user, IP reputation, and geolocation information. It documents the findings in PagerDuty and, for the applicable acknowledgment path, posts a status update and creates a trouble ticket for continued tracking.

This automation manages GitGuardian honeytoken triggers from initial alert through investigation, enrichment, human decision-making, and remediation. It identifies the likely source of the trigger, adds internal or external context, coordinates responses in Slack, and can reset, revoke, or recreate the honeytoken while documenting the incident.

This workflow investigates a suspicious IP address by retrieving baseline reputation, contextual intelligence, and a focused history of scanning activity. It gives analysts a structured view of the IP and its recent behavior without requiring separate lookups.

This scheduled workflow reviews recent cloud account audit activity, uses AI to identify suspicious or sensitive user actions, and enriches questionable events with user history and IP context. When activity requires attention, it sends a detailed alert to the security team for follow-up.

This automation analyzes email headers by extracting embedded IP addresses, checking their reputation and geographic context, and reviewing available SPF, DKIM, and DMARC authentication results. It consolidates those findings into a structured summary to support email threat investigation and spoofing analysis.

This automation retrieves pending AI analyst incidents from the previous seven days, enriches them with linked incident context, and presents concise reports with interactive review actions in a shared Slack thread. Analysts can acknowledge selected incidents directly in Darktrace while keeping the team informed of each decision.

This automation turns an EDR alert into a structured incident case, enriches it with file, IP, computer, and user context, and routes the result according to whether the alert is suspicious. Suspicious alerts are shared with the security team, while non-suspicious cases are documented and closed.

This automation runs recurring searches for keyword-related data leaks, retrieves matching intelligence records, and analyzes the associated dumps in either text or CSV format. It extracts relevant matches together with dump names and dates, producing structured findings ready for investigation or response actions.

This automation investigates WordPress administrator login alerts involving an unfamiliar IP address by enriching the alert, identifying the account, and comparing the IP with the user’s recent successful login history. It notifies IT security with actionable context and, when approved, changes the user’s password and records the incident disposition.

This automation investigates suspicious Office 365 login alerts by applying organization and historical-activity checks, enriching each qualifying alert with user, IP, and email exposure data. It then creates a structured support ticket containing the evidence needed for follow-up.

This automation analyzes an incoming phishing email by extracting sender addresses, URLs, and attachments, then checking each available indicator against reputation and threat-intelligence services. It consolidates the findings into a formatted report and emails the results to the requester.

This automation continuously retrieves recent GitHub audit logs, selects relevant detection rules, and investigates potentially suspicious activity using behavioral and threat-intelligence checks. It delivers enriched, investigation-ready Slack alerts only when anomalous events are identified.

Automates employee-behavior investigations by gathering account activity, connection and IP evidence, breach information, and location context, then producing a structured security assessment and Slack handoff. It replaces scattered lookups with a repeatable triage path, although the configured test values and branch logic should be validated before production use.

This scheduled automation identifies inactive IAM users by reviewing login and account-age information, then routes qualifying accounts through administrative approval and activity investigation. Approved accounts are documented in Jira, checked in CloudTrail, and deleted from IAM.

This automation uses an agent to investigate an endpoint-related request and take an appropriate response through configured endpoint security operations. It replaces a manual review-and-action cycle with a repeatable flow that returns the resulting status.

This automation investigates incoming leaked-credential alerts by retrieving the alert and its screenshot, documenting the issue in Freshservice, and testing whether the credentials are compromised. If the leak is confirmed, it resets the affected user's password and completes the response workflow.

This automation combines related endpoint malware and cloud access alerts, uses an AI-generated explanation to normalize what happened, and delivers the resulting summary to a team channel. It replaces separate alert review with a concise, human-readable incident narrative.

This automation receives a security incident, checks for duplicates and related incidents, and uses automated triage to determine the appropriate response path. It creates a structured incident record with remediation tasks and correlation links when investigation is required, while avoiding duplicate ticket creation.

This automation gathers context for incoming AWS GuardDuty alerts, creates a Jira case, and routes selected alert types to an initial AWS remediation action. It reduces the need to manually investigate each alert, perform the first response step, and document the result.

This automation investigates reported email attachments by retrieving the related message, downloading and unpacking the attachment, and checking its file hash in VirusTotal. It produces structured triage data and security-enrichment results for follow-up analysis.

This automation retrieves threats created during the previous day, gathers the relevant details, and consolidates them into a Jira investigation ticket. It replaces a recurring manual review and reporting process with a consistent threat summary for the security team.

This automation reviews AWS IAM users for inactivity, checks account age and recent activity, and routes potentially dormant accounts through administrator approval. Confirmed concerning accounts generate an investigation issue, receive a CloudTrail review, and are then deleted from IAM.

This automation lets an analyst submit an IP address through a Slack command and receive threat intelligence from VirusTotal, URLScan, and IPinfo in one formatted response. It replaces separate lookups and manual result compilation with a consolidated IP risk and location summary.

This automation analyzes a submitted phishing email by extracting sender addresses, URLs, and attachments, then checking those artifacts against reputation and threat-intelligence services. It formats the findings into a consolidated report and delivers the results by email.

This automation evaluates incoming cloud security findings, enriches them with asset and finding details, and presents responders with an actionable notification. It supports human-guided investigation, URL analysis, evidence collection, ticket creation, email updates, and instance response actions.

This automation enriches a suspicious sign-in alert with identity, sign-in history, IP reputation, download activity, device status, and existing-incident context. It packages the findings into a structured brief for a triage agent, with optional email delivery, without making a conclusion or taking remediation action.

This automation receives a request to investigate endpoint security information and uses an AI agent to reason across endpoint visibility, agents, indicators of compromise, and threats. It returns a consolidated result describing the investigation and actions taken, reducing the need for analysts to perform separate security-console lookups.

This automation searches Logz.io for severe Falco security events, retrieves the logs associated with each event, and creates a Jira issue for every result. It replaces manual alert investigation and ticket creation with a consistent security-operations handoff.

This automation investigates a configured list of domains across multiple threat-intelligence and reputation sources to gather evidence about age, reputation, compromise, safe-browsing status, parked-domain indicators, and related activity. It consolidates the findings into a structured result so analysts can assess suspicious domains and potential false positives with less manual searching.