Cribl MCP 服务器

一个模型上下文协议（MCP）服务器，使AI能够与Cribl API进行交互。

该服务器允许AI客户端使用标准化的MCP工具发现并调用来自Cribl部署的数据操作。

详细的文档，请参阅docs/目录。以下是文档文件的概述：

• README.md（本文档）：提供最高级别的介绍、快速入门指南、非常基础的例子以及指向文档目录的链接。
• docs/configuration.md：特别关注配置所需的环境变量，并解释认证模式。它完全关于设置。
• docs/usage.md：专注于如何运行服务器（通过npx或本地开发命令），以及如何配置MCP客户端以连接到它。它提供了调用工具的概念性示例。
• docs/overview.md：介于README和特定配置/使用文档之间。它详细说明了服务器在认证方面提供的内容，最重要的是，提供了一个关于可用工具及其具体参数/输出的详细参考指南，以及未来的工具。

开始使用

你可以选择安装并在本地运行，或者通过npx即时执行。npx可以让你免去安装Git、依赖项或任何构建工具。两种情况都要求你已经安装了版本16以上的Node.js：

前提条件

要运行此服务器，请确保以下条件满足：

• Node.js 已安装（推荐版本16或更高）
• 互联网访问 可用（用于从npm获取MCP服务器包）

你可以从 https://nodejs.org 安装Node.js。

验证你的设置：

node -v
npx -v

使用npx快速开始

CRIBL_BASE_URL=https://your.cribl.cloud.instance CRIBL_AUTH_TYPE=cloud CRIBL_CLIENT_ID=abc123 CRIBL_CLIENT_SECRET=secret npx @pebbletek/cribl-mcp

注意： 运行npx需要设置必要的环境变量（如CRIBL_BASE_URL和认证详情），这些变量要么在环境中设置，要么直接通过命令行传递给服务器以便成功连接。

有关高级npx使用配置的信息，包括适用于你的MCP客户端的相关JSON和所需变量，请参阅docs/usage.md。

本地开发

1. 浏览到一个高层级文件夹，在那里存储代码库（克隆会创建包含文件夹）。克隆仓库：

   git clone https://github.com/pebbletek/cribl-mcp.git
   cd cribl-mcp
   

2. 安装依赖项：

   npm install
   

3. 复制.env.example文件并填写所需值：

   cp .env.example .env
   

4. 有关运行、构建和启动mcp服务器的信息，请参见 usage.md > 本地开发部分。

有关环境变量和认证的详细信息，请参阅docs/configuration.md，有关运行服务器的信息，请参阅docs/usage.md。

可用工具

该服务器提供了与Cribl交互的工具，包括：

• 列出工作组/队列
• 获取/设置管道配置
• 获取源配置
• 重启工作组
• 查询系统指标（带过滤）

有关详细列表和使用说明，请参见 docs/usage.md。

示例用法（提示）

通过 MCP 客户端（如 Claude Desktop）连接后，您可以使用自然语言提示与 Cribl 实例进行交互，这些提示利用了可用的工具。以下是一些示例：

• Prompt: what sources are we ingesting?
  (you will need to allow the MCP client access to the tool)

  • Response will be something like:
    "To answer your question about ingested sources, let me check the available data sources in your Cribl Stream environment.
    <View result from cribl_getSources from Cribl (local)>

    Let me also check what pipelines are configured in your Cribl Stream environment:
    <View result from cribl_getPipelines from Cribl (local)>

    Based on the information I've retrieved from your Cribl Stream environment, here are the sources you are ingesting:
    Active Data Sources
    Your Cribl Stream instance has several configured data sources, with the following notable ones:

    1. HTTP/HTTPS Sources:
       HTTP source (port 10080)
       Cribl HTTP (port 10200)
       Splunk HEC (port 8088)...
    2. <etc.>

    Pipeline Configurations
    Your environment also has several pipelines configured for processing specific data types:

    1. Cisco ASA events - Filters and samples Cisco ASA security logs
    2. Cisco eStreamer data - Processes Cisco eStreamer data
    3. Palo Alto traffic events - Filters and samples Palo Alto traffic logs
    4. Windows Event Logs - Processes Windows security event logs

    These pipelines suggest you're ingesting network security logs from Cisco ASA firewalls, Cisco eStreamer (likely from Firepower/FTD devices), Palo Alto Networks firewalls, and Windows security events.
    Would you like more detailed information about any specific source or pipeline configuration?"

• Prompt: what functions are processing the palo alto traffic?

  • Response:
    "Let me examine the functions that are processing the Palo Alto traffic in more detail:
    <View result from cribl_getPipelineConfig from Cribl (local)>

    Here's a detailed breakdown of how the Palo Alto traffic data is being processed in your Cribl Stream environment:
    Palo Alto Traffic Pipeline Functions
    1. Initial Filter (Eval):

    • Filter: sourcetype!='pan:traffic'
    • Description: Short-circuits (skips) all events that are NOT of sourcetype 'pan'
    • This is set as a final function, meaning if the condition is true, processing stops for that event

    2. Field Extraction (Regex Extract):

    • Extracts several key fields from the raw event using regex pattern matching:
      • __log_subtype: Identifies if the log is a start/end record
      • __src_zone and __dest_zone: Source and destination security zones
      • __transport: Transport protocol
      • __action: Action taken (allow, deny, etc.)
      • __bytes_in: Bytes received

    3. Filtering Events (Drop):

    • Filter: __log_subtype=='start'
    • Description: Drops all events with log subtype of 'start'
    • Rationale (from comment): "Drop events of log_subtype=start as they often have incorrect app assignment. Log_subtype=end contain better information."
    • etc."

• Prompt: please update the pipeline to include start events as well as end events.

  • Response:
    "I'll update the Palo Alto traffic pipeline to include both "start" and "end" events by modifying the configuration. Let me make this change for you:
    <View result from cribl_getPipelineConfig from Cribl (local)>

    Now I'll update the pipeline configuration to keep both "start" and "end" events by disabling the drop function and updating the comments:
    <View result from cribl_setPipelineConfig from Cribl (local)>

    Now let's restart the worker group to apply these changes:
    <View result from cribl_restartWorkerGroup from Cribl (local)>

    The Palo Alto traffic pipeline has been successfully updated to include both "start" and "end" events. Here's what I modified:

    1. Disabled the Drop Function:

       • The function that was filtering out __log_subtype=='start' events has been disabled
       • This means both "start" and "end" session events will now be processed

    2. Updated the Comment:

       • Changed the comment from explaining why "start" events were being dropped to noting that both event types are now being kept for complete traffic visibility

    3. Restarted the Worker Group:

       • Applied the changes by restarting the Cribl Stream worker group

    The updated pipeline will now process both "start" and "end" events from your Palo Alto firewalls, giving you complete visibility into traffic sessions from initiation through completion. All other processing functions remain in place, including:

    • Field extraction for key traffic attributes
    • Sampling for zero-byte traffic and trusted zone traffic
    • Removal of unreliable date fields

    Your Palo Alto traffic data will now include the complete lifecycle of network connections while still maintaining the efficiency benefits of the sampling rules."

许可证

MIT