Frequently Asked Questions (FAQ) - Enrichment MCP Server

Q: What is an MCP Server? A: MCP stands for Model Context Protocol. An MCP Server acts as a bridge, allowing AI models, particularly Large Language Models (LLMs), to access and interact with external data sources and tools in a standardized manner. This enables the AI to make more informed decisions based on enriched contextual information.

Q: How does the Enrichment MCP Server enhance security? A: The Enrichment MCP Server enriches security data by integrating with multiple security products. It aggregates data from various sources like VirusTotal, AlienVault, and Shodan to provide a comprehensive view of potential threats. This enables faster threat detection and response.

Q: What services are supported by the Enrichment MCP Server? A: Currently, the server supports VirusTotal, Hybrid Analysis, AlienVault, Shodan, Urlscan.io, AbuseIPDB, and HaveIBeenPwned. These services cover various aspects of security intelligence, from malware analysis to IP reputation.

Q: Do I need API keys for all the supported services? A: Yes, most of the supported services require API keys to access their data. You need to obtain API keys from each service you plan to use and configure them in the server’s environment variables or configuration file.

Q: What observable types are supported by the Enrichment MCP Server? A: The server supports IP addresses, domains, URLs, and email addresses. This allows you to enrich a wide range of security data, providing comprehensive threat intelligence.

Q: How do I install and configure the Enrichment MCP Server on UBOS? A: First, install the UBOS CLI. Then, access the UBOS Asset Marketplace to find the Enrichment MCP Server. Follow the provided instructions to configure the server, including setting up the necessary API keys for the supported services.

Q: Can I customize the prompt templates used for enrichment? A: Yes, the Enrichment MCP Server allows you to customize the prompt templates for each service and observable type using Jinja2 templating. This allows you to tailor the enrichment process to your specific needs.

Q: What is UBOS, and how does it relate to the Enrichment MCP Server? A: UBOS is a full-stack AI Agent Development Platform focused on bringing AI Agents to every business department. The Enrichment MCP Server is an asset available on the UBOS Asset Marketplace, showcasing the platform’s capabilities for integrating and managing AI-driven security solutions.

Q: How can the Enrichment MCP Server be used in incident response? A: The server can automate incident response workflows by triggering actions based on enriched security data. For example, if a file hash is identified as malicious, the MCP Server can automatically quarantine the affected system and notify the security team.

Q: Can I contribute to the development of the Enrichment MCP Server? A: Yes, contributions are welcome! You can submit pull requests with bug fixes, new features, or improvements to the documentation.