NetWitness

NetWitness MCP server

NetWitness MCP server

NetWitness MCP server

for Claude, ChatGPT, Cursor and your own agents

for Claude, ChatGPT, Cursor and your own agents

for Claude, ChatGPT, Cursor and your own agents

Expose NetWitness to Claude, ChatGPT, Cursor or your own agents as a governed MCP server, even if the vendor doesnโ€™t ship one. Mindflow turns every API operation into an MCP tool and keeps the connector current when the API changes. The MCP Gateway sits between your AI clients and your data, with scoped access, human approval before sensitive writes and a record of every call.

Expose NetWitness to Claude, ChatGPT, Cursor or your own agents as a governed MCP server, even if the vendor doesnโ€™t ship one. Mindflow turns every API operation into an MCP tool and keeps the connector current when the API changes. The MCP Gateway sits between your AI clients and your data, with scoped access, human approval before sensitive writes and a record of every call.

42

operation

s

available

Complete and up-to-date endpoint coverage by Mindflow.

          42

          operation

          s

          available

          Complete and up-to-date endpoint coverage by Mindflow.

                  42

                  operation

                  s

                  available

                  Complete and up-to-date endpoint coverage by Mindflow.

                          Our customers scale automation with security built in.

                          Tools exposed by this MCP server

                          Every NetWitness operation, as an MCP tool

                          Every NetWitness operation, as an MCP tool

                          Each API operation becomes a tool your AI client can call. You decide which ones: allow reads, require approval before sensitive writes and block the rest. A few of the most used:

                          • NetWitness

                            NetWitness

                            Add a journal entry to an incident

                            Add a journal entry to an incident

                          • NetWitness

                            NetWitness

                            Fetch alerts based on criteria

                            Fetch alerts based on criteria

                          • NetWitness

                            NetWitness

                            Get a single incident by id

                            Get a single incident by id

                          • NetWitness

                            NetWitness

                            Get alerts by date range with pagination

                            Get alerts by date range with pagination

                          • NetWitness

                            NetWitness

                            Get hosts with filtering and sorting

                            Get hosts with filtering and sorting

                          • NetWitness

                            NetWitness

                            Get incidents by date range with pagination

                            Get incidents by date range with pagination

                          • NetWitness

                            NetWitness

                            Get list of snapshots for a host

                            Get list of snapshots for a host

                          • NetWitness

                            NetWitness

                            Get snapshot details for a host

                            Get snapshot details for a host

                          • NetWitness

                            NetWitness

                            Release host from network isolation

                            Release host from network isolation

                          • NetWitness

                            NetWitness

                            Remove an incident by id

                            Remove an incident by id

                          • NetWitness

                            NetWitness

                            Request file download to server

                            Request file download to server

                          • NetWitness

                            NetWitness

                            Request network isolation for a host

                            Request network isolation for a host

                          • NetWitness

                            NetWitness

                            Start a scan on a host

                            Start a scan on a host

                          • NetWitness

                            NetWitness

                            Stop a scan on a host

                            Stop a scan on a host

                          • NetWitness

                            NetWitness

                            Update an incident (status or assignee)

                            Update an incident (status or assignee)

                          • NetWitness

                            Add a journal entry to an incident

                          • NetWitness

                            Fetch alerts based on criteria

                          • NetWitness

                            Get a single incident by id

                          • NetWitness

                            Get alerts by date range with pagination

                          • NetWitness

                            Get hosts with filtering and sorting

                          • NetWitness

                            Get incidents by date range with pagination

                          • NetWitness

                            Get list of snapshots for a host

                          • NetWitness

                            Get snapshot details for a host

                          • NetWitness

                            Release host from network isolation

                          • NetWitness

                            Remove an incident by id

                          • NetWitness

                            Request file download to server

                          • NetWitness

                            Request network isolation for a host

                          • NetWitness

                            Start a scan on a host

                          • NetWitness

                            Stop a scan on a host

                          • NetWitness

                            Update an incident (status or assignee)

                          • NetWitness

                            NetWitness

                            Update an incident (status or assignee)

                            Update an incident (status or assignee)

                          • NetWitness

                            NetWitness

                            Stop a scan on a host

                            Stop a scan on a host

                          • NetWitness

                            NetWitness

                            Start a scan on a host

                            Start a scan on a host

                          • NetWitness

                            NetWitness

                            Request network isolation for a host

                            Request network isolation for a host

                          • NetWitness

                            NetWitness

                            Request file download to server

                            Request file download to server

                          • NetWitness

                            NetWitness

                            Remove an incident by id

                            Remove an incident by id

                          • NetWitness

                            NetWitness

                            Release host from network isolation

                            Release host from network isolation

                          • NetWitness

                            NetWitness

                            Get snapshot details for a host

                            Get snapshot details for a host

                          • NetWitness

                            NetWitness

                            Get list of snapshots for a host

                            Get list of snapshots for a host

                          • NetWitness

                            NetWitness

                            Get incidents by date range with pagination

                            Get incidents by date range with pagination

                          • NetWitness

                            NetWitness

                            Get hosts with filtering and sorting

                            Get hosts with filtering and sorting

                          • NetWitness

                            NetWitness

                            Get alerts by date range with pagination

                            Get alerts by date range with pagination

                          • NetWitness

                            NetWitness

                            Get a single incident by id

                            Get a single incident by id

                          • NetWitness

                            NetWitness

                            Fetch alerts based on criteria

                            Fetch alerts based on criteria

                          • NetWitness

                            NetWitness

                            Add a journal entry to an incident

                            Add a journal entry to an incident

                          • NetWitness

                            Update an incident (status or assignee)

                          • NetWitness

                            Stop a scan on a host

                          • NetWitness

                            Start a scan on a host

                          • NetWitness

                            Request network isolation for a host

                          • NetWitness

                            Request file download to server

                          • NetWitness

                            Remove an incident by id

                          • NetWitness

                            Release host from network isolation

                          • NetWitness

                            Get snapshot details for a host

                          • NetWitness

                            Get list of snapshots for a host

                          • NetWitness

                            Get incidents by date range with pagination

                          • NetWitness

                            Get hosts with filtering and sorting

                          • NetWitness

                            Get alerts by date range with pagination

                          • NetWitness

                            Get a single incident by id

                          • NetWitness

                            Fetch alerts based on criteria

                          • NetWitness

                            Add a journal entry to an incident

                          Connect NetWitness to your AI client in three steps.

                          01

                          Connect the service

                          Add NetWitness in Mindflow with its credentials. They stay in Mindflow and never reach the AI client.

                          02

                          Choose the tools

                          Pick the operations each AI client may call. Allow reads, require approval before sensitive writes and block the rest.

                          03

                          Connect your AI client

                          Point Claude, ChatGPT, Cursor or your own agent to your MCP Gateway endpoint, then check real calls in the audit log.

                          Use cases

                          Use cases

                          What your AI agents can do with NetWitness

                          What your AI agents can do with NetWitness

                          AI clients

                          Mindflow

                          NetWitness

                          โ†’ Automate incident triage pain points by fetching incident stats and user-specific behavior data automatically, allowing security teams to prioritize and respond faster using the integrated API operations โ†’ Streamline host containment challenges by scheduling network isolation, risk resets, and snapshot retrieval through automated sequences that reduce manual intervention and accelerate threat mitigation โ†’ Enhance file handling processes by automating file download requests and checksum-based file blocking or unblocking, reducing the risk of compromised files spreading through the enterprise

                          โ†’ Automate incident triage pain points by fetching incident stats and user-specific behavior data automatically, allowing security teams to prioritize and respond faster using the integrated API operations โ†’ Streamline host containment challenges by scheduling network isolation, risk resets, and snapshot retrieval through automated sequences that reduce manual intervention and accelerate threat mitigation โ†’ Enhance file handling processes by automating file download requests and checksum-based file blocking or unblocking, reducing the risk of compromised files spreading through the enterprise

                          Every call goes through one governed endpoint.

                          Every call goes through one governed endpoint.

                          Your AI clients get access. You keep control.

                          Your AI clients get access. You keep control.

                          Every call to NetWitness goes through the Mindflow MCP Gateway. The same policies apply to every AI client: role-based access by team and environment, scoped credentials that never reach the client, human approval before sensitive writes, and a log of every call you can export to your SIEM.

                          Every call to NetWitness goes through the Mindflow MCP Gateway. The same policies apply to every AI client: role-based access by team and environment, scoped credentials that never reach the client, human approval before sensitive writes, and a log of every call you can export to your SIEM.

                          NetWitness MCP server

                          Live

                          RBAC ยท SecOps

                          Scoped credentials

                          Audit log

                          Add a journal entry to an incident

                          Allowed

                          Fetch alerts based on criteria

                          Allowed

                          Get a single incident by id

                          Needs approval

                          Get alerts by date range with pagination

                          Blocked

                          Every call logged ยท Export to SIEM

                          Put this MCP server to work.

                          Bring one AI client and the tools it needs. Weโ€™ll show you the setup in Mindflow, from scoped access to the audit log.

                          Put this MCP server to work.

                          Bring one AI client and the tools it needs. Weโ€™ll show you the setup in Mindflow, from scoped access to the audit log.

                          Less busywork. More possibility.

                          Let your agents handle the routine. Make room for what comes next.

                          Automation intelligence, delivered monthly.

                          Product releases, automation playbooks, and security research โ€” straight to your inbox. No spam, unsubscribe anytime.

                          ยฉ 2026 Mindflow โ€” All rights reserved.

                          SOC 2 Type II
                          ISO 27001
                          GDPR
                          France 2030
                          Bpifrance
                          รŽle-de-France

                          Less busywork. More possibility.

                          Let your agents handle the routine. Make room for what comes next.

                          Automation intelligence, delivered monthly.

                          Product releases, automation playbooks, and security research โ€” straight to your inbox. No spam, unsubscribe anytime.

                          ยฉ 2026 Mindflow โ€” All rights reserved.

                          SOC 2 Type II
                          ISO 27001
                          GDPR
                          France 2030
                          Bpifrance
                          รŽle-de-France

                          Less busywork. More possibility.

                          Let your agents handle the routine. Make room for what comes next.

                          Automation intelligence, delivered monthly.

                          Product releases, automation playbooks, and security research โ€” straight to your inbox. No spam, unsubscribe anytime.

                          ยฉ 2026 Mindflow โ€” All rights reserved.

                          SOC 2 Type II
                          ISO 27001
                          GDPR
                          France 2030
                          Bpifrance
                          รŽle-de-France