# SigmaLineage MCP

> Use this tool when you need to identify real threats from security logs and transform raw alerts into actionable intelligence. It enables context-aware hunting with process lineage tracing and rarity baselining, surfacing threats from EVTX logs. Ideal for security analysts and threat hunters seeking to uncover kill chain intelligence from large volumes of security data.

Canonical page: https://skillsregistry.net/skills/mohitdabas-sigmalineage-mcp  
JSON: https://api.skillsregistry.net/v1/skills/mohitdabas-sigmalineage-mcp

## Description

Enables context-aware EVTX hunting with process lineage tracing and rarity baselining to surface real threats from security logs, transforming raw alerts into actionable kill chain intelligence.

## Trust

- **Trust score (0–1):** 0.69
- **Verification tier:** scanned
- **Last scanned:** 2026-08-30

## Facts

- **Version:** 1.0.0
- **Skill type:** atomic
- **Execution layer:** mcp-remote
- **Runtime environment:** api
- **Category:** security
- **Updated:** 2026-08-30

## Source

- **Source listing:** [Glama](https://glama.ai/mcp/servers/isr1x3dkvq)
- **Repository:** <https://github.com/MohitDabas/sigmalineage-mcp>

## Use it

Resolve this record through the SkillsRegistry MCP server (no auth, read-only):

```
claude mcp add --transport http --scope user skillsregistry https://api.skillsregistry.net/mcp
```

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_skill",
    "arguments": {
      "slug": "mohitdabas-sigmalineage-mcp"
    }
  }
}
```

REST: `GET https://api.skillsregistry.net/v1/skills/mohitdabas-sigmalineage-mcp` · pull for local use: `GET https://api.skillsregistry.net/v1/skills/mohitdabas-sigmalineage-mcp/pull`

---
SkillsRegistry indexes agent skills from public registries and GitHub. Skills we have analysed are scanned with Circle-IR and scored on six dimensions; each listing states its scan coverage. More: https://skillsregistry.net/llms.txt