[{"data":1,"prerenderedAt":16},["ShallowReactive",2],{"$fhWLL20C07rJjrnQcob-otEXqazkfuvJFgrog0DJeH0U":3},{"slug":4,"title":5,"excerpt":6,"html":7,"publishedAt":8,"updatedAt":9,"author":10,"tags":11,"featureImage":13,"readingTime":14,"canonical":15},"understanding-mcp-for-use-in-ai-siem-soar","Understanding MCP for use in AI-SIEM/SOAR","if we’re going to move beyond toy examples and build real, automated Gen-AI workflows — especially in high-stakes domains like SOAR or SIEM — we need more…","\n\u003C!--kg-card-begin: html-->\n\u003Cdiv id=\"elevenlabs-audionative-widget\" data-height=\"90\" data-width=\"100%\" data-frameborder=\"no\" data-scrolling=\"no\" data-publicuserid=\"ae3cda78c4a99172f99dbfb050207098d88a71401457ade2c9f5329e0b9185ed\" data-playerurl=\"https://elevenlabs.io/player/index.html\" >\u003C/div>\u003Cscript src=\"https://elevenlabs.io/player/audioNativeHelper.js\" type=\"text/javascript\">\u003C/script>\n\u003C!--kg-card-end: html-->\n\u003Cp>A common pattern in AI integrations is to expose APIs that the language model can call based on natural language prompts. These APIs aren’t invented by the AI, they’re defined ahead of time by developers, often using standards like OpenAPI, so the AI understands what functions are available and how to use them. You see this approach frequently in automation platforms like N8N and bot orchestration tools, where workflows are built around these structured interfaces. For example, a developer might define an API that retrieves the weather for a given city and timestamp, and the model is taught to call it when someone asks, “What’s the weather in Paris?” This works well for public or low-risk data, where access control is minimal and API keys are hardcoded or safely shared in runtime environments.\u003C/p>\u003Cp>But this approach \u003Cstrong>breaks down entirely\u003C/strong> when the data being accessed is sensitive. These traditional API mechanisms don’t solve the problem of \u003Cstrong>context-aware, authenticated access\u003C/strong>. For instance, if a user asks the AI to analyze financial records stored locally or behind enterprise controls, we can’t simply expose those systems through public APIs or bake access tokens into the workflow. This is where \u003Cstrong>Model Context Protocol (MCP)\u003C/strong> comes in. Instead of using APIs in the traditional sense, MCP provides a \u003Cstrong>governed and authenticated channel\u003C/strong> for the model to request only the specific context it needs, without exposing the full dataset and without giving the model direct, persistent access to secure systems. It’s a fundamentally different approach: not just defining functions, but enforcing \u003Cstrong>who can access what, when, and why\u003C/strong>.\u003C/p>\u003Ch2 id=\"using-calls-for-business-applications\">Using Calls for Business Applications\u003C/h2>\u003Cp>So why does this matter? Because if we’re going to move beyond toy examples and build real, automated Gen-AI workflows, especially in high-stakes domains like SOAR or SIEM, we need more than just clever prompting. We need structure. We need security. And we need governance. \u003Cstrong>Model Context Protocol (MCP)\u003C/strong> isn’t just a way to make an AI “talk to your data”, it’s the critical layer that enforces \u003Cem>who\u003C/em> gets access to \u003Cem>what\u003C/em>, \u003Cem>when\u003C/em>, and \u003Cem>under what conditions\u003C/em>. It’s how we give AI the context it needs, \u003Cstrong>without giving up control\u003C/strong>. And in security operations, where access to logs, alerts, identity data, and historical behavior must be governed, this control isn’t optional, it’s mandatory. That’s why \u003Cstrong>Fluency is the first SIEM to natively support MCP\u003C/strong>, allowing AI developers to query live SIEM data securely and programmatically. If you’re building next-generation, AI-driven security workflows, Fluency is already ahead. In the sections that follow, we’ll unpack exactly how MCP works, why it matters for compliance, and how it forms the foundation for intelligent, safe, and actionable AI in modern cybersecurity.\u003C/p>\u003Cp>At its core, \u003Cstrong>Model Context Protocol (MCP)\u003C/strong> is a service architecture designed to securely provide AI models with access to external data, tools, and memory, without embedding that data into the model itself. Officially, MCP is defined as a protocol for enabling \u003Cstrong>governed, structured, and authenticated access\u003C/strong> to contextual information during AI execution. The specification breaks MCP into \u003Cstrong>three layers\u003C/strong>:\u003C/p>\u003Col>\u003Cli>\u003Cstrong>Planner\u003C/strong> – determines which tools or data sources are needed,\u003C/li>\u003Cli>\u003Cstrong>Retriever\u003C/strong> – securely accesses those data sources, and\u003C/li>\u003Cli>\u003Cstrong>Dispatcher\u003C/strong> – formats and delivers results to the model.This architecture allows AI systems to make dynamic, policy-aware requests for context without breaching data governance or exposing sensitive sources.\u003C/li>\u003C/ol>\u003Cp>You can find the formal definition and evolving specification of MCP at its official site: \u003Ca href=\"https://modelcontext.org/?ref=blogs.fluencysecurity.com\">https://modelcontext.org\u003C/a>\u003C/p>\u003Ch2 id=\"video-resources\">Video Resources\u003C/h2>\u003Cp>If you’re curious about the technical architecture behind \u003Cstrong>Model Context Protocol (MCP)\u003C/strong> — or you’re building AI systems that need to access real-time, sensitive, or structured data — there are some great resources available to help you understand how MCP works under the hood:\u003C/p>\u003Cul>\u003Cli>\u003Cstrong>Dan Clarke’s “Getting Started with MCP”\u003C/strong> offers a recent, straightforward walk-through ideal for learners just beginning to explore the protocol. It clarifies the motivation behind MCP and how it operates in practice. \u003Ca href=\"https://www.youtube.com/watch?v=DpyjAKmNwpI&ref=blogs.fluencysecurity.com\">https://www.youtube.com/watch?v=DpyjAKmNwpI\u003C/a>\u003C/li>\u003Cli>\u003Cstrong>“MCP Explained in 17 Minutes”\u003C/strong> dives into why MCP matters, how it solves integration challenges, and walks through the architecture, typical workflow, and real-world use cases in a concise format. \u003Ca href=\"https://www.youtube.com/watch?v=G5KyIzV-254&ref=blogs.fluencysecurity.com\">https://www.youtube.com/watch?v=G5KyIzV-254\u003C/a>\u003C/li>\u003C/ul>\u003Cp>These videos are perfect starting points if you’re new to the concept of MCP and want to see how it functions in real-world settings. They break down the architecture, use cases, and benefits, without overwhelming technical detail.\u003C/p>\u003Ch2 id=\"beyond-technical-need\">Beyond Technical Need\u003C/h2>\u003Cp>Finally, it’s important to recognize that MCP isn’t just a technical convenience, it’s a \u003Cstrong>governance imperative\u003C/strong>. As enterprises move toward AI-driven workflows, especially in regulated environments, questions of \u003Cstrong>how data is accessed, who can see it, and under what conditions\u003C/strong> become central to compliance and risk management. This is where \u003Cstrong>ISO/IEC 42001\u003C/strong>, the international standard for AI management systems, becomes highly relevant. MCP directly supports its principles by enabling \u003Cstrong>stateless, policy-enforced access\u003C/strong> to data. Rather than storing sensitive context inside the model or granting broad, persistent access, MCP allows AI systems to retrieve \u003Cstrong>just-in-time information through authenticated, auditable pathways\u003C/strong>. It provides a structured method for enforcing data boundaries, not just technically, but procedurally and contractually. In this way, MCP becomes a cornerstone for building AI systems that are not only powerful, but also secure, compliant, and trustworthy by design.\u003C/p>\u003Cp>In the end, MCP isn’t just a helpful tool, it’s a \u003Cstrong>necessary foundation\u003C/strong> for using AI responsibly and effectively within enterprise environments. As we’ve seen, it enables secure, governed, and stateless access to sensitive data, aligning with both \u003Cstrong>technical best practices\u003C/strong> and emerging standards like \u003Cstrong>ISO/IEC 42001\u003C/strong>. But more importantly, \u003Cstrong>MCP is becoming the standard\u003C/strong> for integrating large language models with real-world data. If you’re working with SIEM data, data lakes, or any security telemetry, and you expect to layer AI on top, \u003Cstrong>you need MCP in place\u003C/strong>. It’s not optional. Without it, you’re either overexposing your data, underutilizing your AI, or relying on brittle, insecure workarounds. Today, organizations that don’t yet support MCP, or don’t even acknowledge it, are signaling that they haven’t yet caught up to where AI-driven security is going. If you want your AI to work with your most important data safely and intelligently, MCP is how you make that possible.\u003C/p>\u003Cdiv class=\"kg-card kg-signup-card kg-width-wide \" data-lexical-signup-form=\"\" style=\"background-color: #F0F0F0; display: none;\">\n            \n            \u003Cdiv class=\"kg-signup-card-content\">\n                \n                \u003Cdiv class=\"kg-signup-card-text \">\n                    \u003Ch2 class=\"kg-signup-card-heading\" style=\"color: #000000;\">\u003Cspan style=\"white-space: pre-wrap;\">Sign up for Fluency Security\u003C/span>\u003C/h2>\n                    \u003Cp class=\"kg-signup-card-subheading\" style=\"color: #000000;\">\u003Cspan style=\"white-space: pre-wrap;\">News, research, and insights from Fluency — the cybersecurity platform redefining real-time detection and AI-driven analysis.\u003C/span>\u003C/p>\n                    \n        \u003Cform class=\"kg-signup-card-form\" data-members-form=\"signup\">\n            \n            \u003Cdiv class=\"kg-signup-card-fields\">\n                \u003Cinput class=\"kg-signup-card-input\" id=\"email\" data-members-email=\"\" type=\"email\" required=\"true\" placeholder=\"Your email\">\n                \u003Cbutton class=\"kg-signup-card-button kg-style-accent\" style=\"color: #FFFFFF;\" type=\"submit\">\n                    \u003Cspan class=\"kg-signup-card-button-default\">Subscribe\u003C/span>\n                    \u003Cspan class=\"kg-signup-card-button-loading\">\u003Csvg xmlns=\"http://www.w3.org/2000/svg\" height=\"24\" width=\"24\" viewBox=\"0 0 24 24\">\n        \u003Cg stroke-linecap=\"round\" stroke-width=\"2\" fill=\"currentColor\" stroke=\"none\" stroke-linejoin=\"round\" class=\"nc-icon-wrapper\">\n            \u003Cg class=\"nc-loop-dots-4-24-icon-o\">\n                \u003Ccircle cx=\"4\" cy=\"12\" r=\"3\">\u003C/circle>\n                \u003Ccircle cx=\"12\" cy=\"12\" r=\"3\">\u003C/circle>\n                \u003Ccircle cx=\"20\" cy=\"12\" r=\"3\">\u003C/circle>\n            \u003C/g>\n            \u003Cstyle data-cap=\"butt\">\n                .nc-loop-dots-4-24-icon-o{--animation-duration:0.8s}\n                .nc-loop-dots-4-24-icon-o *{opacity:.4;transform:scale(.75);animation:nc-loop-dots-4-anim var(--animation-duration) infinite}\n                .nc-loop-dots-4-24-icon-o :nth-child(1){transform-origin:4px 12px;animation-delay:-.3s;animation-delay:calc(var(--animation-duration)/-2.666)}\n                .nc-loop-dots-4-24-icon-o :nth-child(2){transform-origin:12px 12px;animation-delay:-.15s;animation-delay:calc(var(--animation-duration)/-5.333)}\n                .nc-loop-dots-4-24-icon-o :nth-child(3){transform-origin:20px 12px}\n                @keyframes nc-loop-dots-4-anim{0%,100%{opacity:.4;transform:scale(.75)}50%{opacity:1;transform:scale(1)}}\n            \u003C/style>\n        \u003C/g>\n    \u003C/svg>\u003C/span>\n                \u003C/button>\n            \u003C/div>\n            \u003Cdiv class=\"kg-signup-card-success\" style=\"color: #000000;\">\n                Email sent! Check your inbox to complete your signup.\n            \u003C/div>\n            \u003Cdiv class=\"kg-signup-card-error\" style=\"color: #000000;\" data-members-error=\"\">\u003C/div>\n        \u003C/form>\n        \n                    \u003Cp class=\"kg-signup-card-disclaimer\" style=\"color: #000000;\">\u003Cspan style=\"white-space: pre-wrap;\">No spam. Unsubscribe anytime.\u003C/span>\u003C/p>\n                \u003C/div>\n            \u003C/div>\n        \u003C/div>","2025-07-30T07:38:54.000-04:00","2025-08-21T15:45:23.000-04:00","Chris Jordan",[12],"AI","https://storage.ghost.io/c/40/d4/40d450c8-df95-4dae-b590-5f6312e7dcb7/content/images/2025/07/mcpTemp.png",5,"https://fluencysecurity.com/blog/understanding-mcp-for-use-in-ai-siem-soar/",1787330593784]