Integration

Sekoia.io integration

Sekoia.io API for detection and response: read and triage the alerts raised in the operation centre, move them through their workflow, discuss them in comments, resolve the kill chain and the assets behind them, browse the asset inventory and enrich it with attributes, run asynchronous searches over the collected events, list the detection rules of the catalogue, and enrich an observable against the intelligence centre for indicators and their STIX context.

Connect Sekoia.io How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Sekoia.io.Built from the 18 Sekoia.io tools below, on the connection you add once.

Common Sekoia.io use cases

pulling the observables of an alert for enrichment
auditing which detection rules are enabled on the tenant
waiting for an event search to finish before reading its rows
resolving the assets referenced by an alert into named systems
closing an alert automatically once enrichment shows it is benign
attaching the result of an automated enrichment to the alert itself
searching the collected events for an indicator found during triage
building a triage queue of pending alerts above an urgency threshold
collecting the events that matched an indicator during an investigation
turning the asset identifiers of an alert into named systems and owners

What you can do with Sekoia.io

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Alert, 3 operations

get_alertGet alertGETReturns one Sekoia.io alert with everything attached to it.
list_alertsList alertsGETLists Sekoia.io alerts filtered by status, urgency, type or date range.
update_alert_statusUpdate alert statusPATCHApplies a workflow transition to a Sekoia.io alert.

Alert comment, 2 operations

add_alert_commentAdd alert commentPOSTAdds a comment to a Sekoia.io alert.
list_alert_commentsList alert commentsGETReads the discussion recorded on a Sekoia.io alert.

Asset, 2 operations

get_assetGet assetGETReturns one Sekoia.io asset with its criticality, attributes and keys.
list_assetsList assetsGETLists the assets Sekoia.io knows about, optionally filtered by type.

Event search job, 2 operations

create_event_search_jobCreate event search jobPOSTStarts a Sekoia.io event search and returns the job identifier to poll.
get_event_search_jobGet event search jobGETPolls a Sekoia.io event search job and reports whether it has finished.

Alert workflow, 1 operation

get_alert_workflowGet alert workflowGETLists the state transitions an alert can currently take.

Asset attribute, 1 operation

add_asset_attributeAdd asset attributePOSTAdds a descriptive attribute to a Sekoia.io asset.

Case, 1 operation

list_casesList casesGETLists Sekoia.io cases and finds the case an alert was attached to.

Event, 1 operation

list_event_search_resultsList event search resultsGETReturns the events matched by a completed Sekoia.io search job.

Indicator, 1 operation

lookup_indicatorLookup indicatorGETReturns the Sekoia.io intelligence indicators matching an observable value.

Indicator context, 1 operation

get_indicator_contextGet indicator contextGETReturns the STIX context linking an observable to actors, malware and campaigns.

Kill chain, 1 operation

get_kill_chainGet kill chainGETResolves a Sekoia.io kill chain identifier into its named phases.

Observable, 1 operation

lookup_observableLookup observableGETChecks whether the Sekoia.io intelligence centre knows an observable.

Rule, 1 operation

list_rulesList rulesGETLists the Sekoia.io detection rules with their severity and enabled state.

Use Sekoia.io from Claude Code, Cursor or Codex

Connect Sekoia.io in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Sekoia.io operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Sekoia.io

Create your workspace
Sign up free. Nothing to install.
Connect Sekoia.io once
Add your Sekoia.io connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

Sekoia.io integration FAQ

What can you do with the Sekoia.io integration?

LiveContext exposes 18 operations on Sekoia.io, covering alert, alert comment, asset and event search job. Common uses include pulling the observables of an alert for enrichment, auditing which detection rules are enabled on the tenant and waiting for an event search to finish before reading its rows.