Summit Talk: Build Custom MCP Servers to Arm Your Threat Hunting Agents

Can your SIEM find the needle in the haystack — or does it need a smarter partner?

Join Matt Franz, AI Security Lead at Bespin Global, as he shows you how to vibe-code a custom MCP Server for your SIEM in Go, whether or not your vendor already ships one.

In 25 minutes, you’ll benefit from Matt’s experience building tools for SentinelOne, Osquery, Coralogix, and Elastic and learn:

• A method for building and reusing client libraries even when your vendor offers no SDK or API spec
• Hands-on techniques for wiring your MCP Server into coding agents and agent frameworks
• Practical approaches to tuning tool calling, prompting, and query guardrails to cut latency
• Testing, observability, and caching strategies to optimize queries for your datasets
• A git/markdown threat-hunting workflow you can operationalize into a persistent knowledge base
• MCP security concerns are real, but local MCP servers can be built and run safely, with significant payoff for your team (human and agentic alike).

You might even save a token or two!

Chat with your fellow AI Summit attendees in the Antisyphon Discord server: https://discord.gg/antisyphon

---

 This talk is part of Antisyphon Training’s Infosec: Age of AI Summit, a free, six-hour, live virtual event designed to give you a practical, real-world look at how cyber experts are using AI and what security professionals need to know as adoption grows.

For those who want to go further, high-quality, affordable hands-on workshops are available Aug. 17-18 to help you learn AI security concepts, techniques, and tactics.

See the entire Antisyphon Training Course Catalog for affordable cybersecurity training! 

---