DeepTempo Security Intelligence Demo

Unified Security Intelligence: Leverage Claude to automatically correlate Splunk security incidents with DeepTempo threat intelligence

🎯 Overview

This repository demonstrates how Claude Desktop can orchestrate multiple MCP (Model Context Protocol) servers to provide unified security intelligence. Instead of manually switching between Splunk and DeepTempo, security analysts can ask Claude natural language questions and get comprehensive, correlated security insights.

The Problem

Security analysts traditionally need to:

1. Query Splunk for high-confidence security incidents
2. Manually extract impacted IP addresses
3. Switch to DeepTempo to look up threat intelligence
4. Correlate findings across both platforms
5. Build a unified security report

This is time-consuming and error-prone.

The Solution

With this demo, Claude becomes your intelligent security orchestration layer:

sequenceDiagram
    participant Analyst
    participant Claude
    participant SplunkMCP as Splunk MCP
    participant DeepTempoMCP as DeepTempo MCP
    
    Analyst->>Claude: "Show me high-confidence incidents and threat intel"
    Claude->>SplunkMCP: Query incidents
    SplunkMCP-->>Claude: Incidents + IPs
    Note over Claude: Extracts IP addresses
    Claude->>DeepTempoMCP: Query threat intel for IPs
    DeepTempoMCP-->>Claude: Threat intelligence
    Claude-->>Analyst: Unified security report

Loading

Result: A single question to Claude produces a comprehensive security report combining data from both platforms.

🚀 Quick Start

Prerequisites

• Python 3.10+
• Claude Desktop
• Access to Splunk instance
• DeepTempo environment configured

Installation

1. Clone this repository with submodules:

   git clone --recursive https://github.com/mando222/DeepTempoUtils.git
   cd DeepTempoUtils

2. Run the setup script:

   ./setup.sh

3. Configure Claude Desktop (see config/claude_desktop_config.json for example)

4. Start using Claude! Open Claude Desktop and try the example queries in DEMO_GUIDE.md

📚 What's Included

MCP Servers (Git Submodules)

This demo uses two MCP server implementations:

1. Splunk MCP SOC - Query Splunk for security incidents, pivot by IP, detect lateral movement, and more

   • Tools: pivot_by_ip, search_splunk, find_lateral_movement, build_attack_timeline
   • Features: SOC investigation workflows, label harvesting, threat intel enrichment

2. DeepTempo MCP Servers - Access DeepTempo findings, cases, and threat intelligence

   • Servers: deeptempo-findings, tempo-flow, approval, attack-layer
   • Features: Finding management, MITRE ATT&CK mapping, investigation workflows

Documentation

• DEMO_GUIDE.md - Step-by-step demo script with example prompts
• config/demo-queries.md - Pre-written queries to copy-paste
• examples/example-workflow.md - Sample outputs and expected results

💡 Use Cases

Incident Investigation

Query: "Show me the highest confidence security incidents from Splunk in the last 24 hours"

Claude will use the Splunk MCP to pull incidents, extract key details, and present them in an organized format.

IP Threat Intelligence

Query: "What does DeepTempo know about these IPs: 192.168.1.100, 10.0.0.50?"

Claude will query the DeepTempo MCP for threat intelligence, findings, and historical context about the specified IPs.

Unified Security Report

Query: "Give me a complete security report: pull high-confidence incidents from Splunk, extract the impacted IPs, and show me what DeepTempo says about them"

Claude will:

1. Query Splunk for incidents
2. Extract IP addresses from the results
3. Query DeepTempo for each IP
4. Combine everything into a unified report with recommendations

🏗️ Architecture

graph TB
    subgraph userLayer [User Layer]
        analyst[Security Analyst]
    end
    
    subgraph orchestration [Orchestration Layer]
        claude[Claude Desktop]
    end
    
    subgraph mcpServers [MCP Server Layer]
        splunkMCP[Splunk MCP Server]
        deeptempoMCP[DeepTempo MCP Servers]
    end
    
    subgraph dataSources [Data Sources]
        splunk[Splunk SIEM]
        deeptempo[DeepTempo SOC]
    end
    
    analyst -->|Natural Language| claude
    claude -->|MCP Protocol| splunkMCP
    claude -->|MCP Protocol| deeptempoMCP
    splunkMCP -->|SDK| splunk
    deeptempoMCP -->|API| deeptempo

Loading

🎬 Demo Workflow

1. Setup - Ensure both MCP servers are running and configured in Claude Desktop
2. Query Splunk - Ask Claude to find high-confidence incidents
3. Extract IPs - Claude automatically identifies impacted IP addresses
4. Query DeepTempo - Claude enriches the data with threat intelligence
5. Unified Report - Claude presents a comprehensive security analysis

See DEMO_GUIDE.md for detailed instructions.

🛠️ Configuration

Example Claude Desktop configuration:

{
  "mcpServers": {
    "splunk-soc": {
      "command": "python",
      "args": ["/path/to/DeepTempoUtils/splunk-mcp-soc/splunk_mcp.py", "stdio"],
      "env": {
        "SPLUNK_HOST": "localhost",
        "SPLUNK_PORT": "8089",
        "SPLUNK_USERNAME": "admin",
        "SPLUNK_PASSWORD": "your-password"
      }
    },
    "deeptempo-findings": {
      "command": "python3",
      "args": ["/path/to/DeepTempoUtils/deeptempo-mcp-servers/servers/deeptempo_findings.py"],
      "env": {
        "DEMO_MODE": "true"
      }
    }
  }
}

See config/claude_desktop_config.json for a complete example.

📊 Repository Structure

DeepTempoUtils/
├── README.md                           # This file
├── DEMO_GUIDE.md                       # Step-by-step demo instructions
├── setup.sh                            # Quick setup script
├── .gitmodules                         # Git submodule configuration
├── config/
│   ├── claude_desktop_config.json     # Example Claude Desktop config
│   └── demo-queries.md                # Ready-to-use demo queries
├── examples/
│   └── example-workflow.md            # Sample outputs and workflows
├── deeptempo-mcp-servers/             # DeepTempo MCP servers (submodule)
└── splunk-mcp-soc/                    # Splunk MCP server (submodule)

🔗 Related Projects

• Splunk MCP SOC - MCP server for Splunk security operations
• DeepTempo MCP Servers - MCP servers for DeepTempo AI SOC
• FastMCP - Framework used to build these MCP servers
• Model Context Protocol - Protocol specification

🤝 Contributing

This is a demonstration repository showing how to combine multiple MCP servers. Feel free to:

• Fork and customize for your environment
• Add additional MCP servers
• Extend the demo scenarios
• Submit issues or improvements

📝 License

This demonstration repository follows the licenses of its submodules:

• Splunk MCP SOC: Apache 2.0
• DeepTempo MCP Servers: MIT

🎓 Learn More

• MCP Protocol: https://modelcontextprotocol.io/
• Claude Desktop: https://claude.ai/desktop
• Splunk SDK: https://dev.splunk.com/python
• DeepTempo: See the deeptempo-mcp-servers README

---

Built for the AI-native SOC 🚀 | Demo-ready in 5 minutes ⚡