# How MCP can help us investigate security incidents faster

DevFeed: [How MCP can help us investigate security incidents faster](<https://devfeed.tech/articles/how-mcp-can-help-us-investigate-security-incidents-faster-57305.md>)

Original publisher: [Read original article](<https://www.thoughtworks.com/insights/blog/leadership/how-MCP-can-help-us-investigate-security-incidents-faster>)

Author: Zichuan Xiong, Paul Rinaldi, Jack Naglieri

Published: 2025-07-09T00:00:00Z

Content type: article

Language: en

Sources: [Thoughtworks Insights](<https://devfeed.tech/sources/thoughtworks-insights.md>)

Topics: [Security](<https://devfeed.tech/topics/security.md>), [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [site-reliability-engineering](<https://devfeed.tech/topics/site-reliability-engineering.md>), [incident](<https://devfeed.tech/topics/incident.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [VPC Flow Logs](<https://devfeed.tech/topics/vpc-flow-logs.md>)

Tags: [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [alert-triage](<https://devfeed.tech/tags/alert-triage.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [iam](<https://devfeed.tech/tags/iam.md>), [iam-roles](<https://devfeed.tech/tags/iam-roles.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [kubernetes-audit-logs](<https://devfeed.tech/tags/kubernetes-audit-logs.md>), [logs](<https://devfeed.tech/tags/logs.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [reliability-engineering](<https://devfeed.tech/tags/reliability-engineering.md>), [security](<https://devfeed.tech/tags/security.md>), [security-incidents](<https://devfeed.tech/tags/security-incidents.md>)

## AI overview

This article argues that security context should become a core part of AI-assisted site reliability engineering. It describes capabilities for investigating security incidents, including cloud change-history inspection, time-based alert correlation, behavioral detection rules, and contextual analysis of activity logs from sources such as VPC Flow Logs and Kubernetes audit logs.

## Source excerpt

How MCP can help us investigate security incidents faster