Command Zero has introduced a powerful set of API endpoints along with a Model Context Protocol (MCP) server to enhance its Autonomous and AI-Assisted Security Operations Center (SOC) platform. With this release, the company enables customers to programmatically drive threat hunting, streamline investigations, manage business context, and trigger remediation workflows by directly connecting to its LLM-based agents.

As Security Operations Centers increasingly rely on multiple tools, integration and automation have become critical priorities. However, many organizations still struggle with fragmented systems and limited interoperability. To address this challenge, Command Zero now allows teams to seamlessly connect its platform into existing SOAR playbooks, orchestration pipelines, and internal tools. Consequently, security teams no longer need to wait for vendor-specific integrations, as they can build and deploy connections independently.

“With aggressive growth in the availability of agentic SecOps capabilities, security leaders and architects are at an architectural juncture – facing a decision to either adopt agentic feature sets being added to existing security tools and platforms, or to instead invest in net-new autonomous SOC platforms – further increasing complexity to an already overwhelming SecOps tools environment. Command Zero is solving this architectural challenge, adding APIs and MCP server access to powerful autonomous investigation capabilities that can be woven into existing tools, workflows, and UI.”
— Dave Gruber, Principal Analyst, Cybersecurity, Omdia

Furthermore, the introduction of APIs and the MCP server significantly enhances flexibility for both customers and partners. Technical alliance partners, for instance, can now build integrations within minutes. At the same time, developers gain direct access to Command Zero’s advanced investigation engine, enabling the creation of custom workflows and innovative security solutions.

“Opening Command Zero’s advanced investigation engine to developers changes what’s possible. Teams can now use advanced capabilities of the platform as the substrate for custom threat hunting frameworks, CTI-driven analysis, and bespoke tooling. The MCP server extends that to AI agents which matters as agentic SecOps moves from pitch decks to day-to-day practice.”
— Richard Stiennon, Chief Research Analyst at IT-Harvest

In addition, the release introduces several key capabilities that strengthen the platform’s functionality. Investigation APIs allow users to create, manage, and retrieve investigations using predefined templates. Meanwhile, business context APIs enable organizations to upload and access contextual data at scale, integrating seamlessly with platforms such as ServiceNow, CTEM tools, and HR systems. Similarly, catalog and schema APIs help align external systems with Command Zero’s internal data model, while remediation APIs allow teams to execute response actions directly from external environments.

Notably, the MCP server acts as a bridge between the platform and AI agents like Claude, enabling analysts to query the system through natural language interfaces. This feature allows teams to run health checks, triage cases, and even build custom dashboards without relying on traditional interfaces.

As a result, organizations can now develop advanced use cases such as automated SOAR playbooks that trigger investigations in real time, custom threat hunting frameworks powered by threat intelligence, and AI-driven SOC dashboards that provide actionable insights. Managed Security Service Providers (MSSPs) can also benefit by synchronizing business context across multiple environments automatically.

“The best security platforms are the ones teams can build on. This release puts Command Zero’s investigation engine in the hands of our customers and our technical alliance partners. They can wire us into their pipelines, extend us with their own flows, and connect us to the AI agents working collaboratively with their analysts. That is how a platform earns its place in the SOC. These APIs and MCP servers unlock a new class of joint solutions with our partners.”
— Dov Yoran, Co-founder and CEO, Command Zero

Overall, this release positions Command Zero at the forefront of agentic SecOps innovation, enabling organizations to reduce complexity, improve automation, and build highly customized, AI-driven security operations.

Recommended Cyber Technology News:

To participate in our interviews, please write to our CyberTech Media Room at info@intentamplify.com  



🔒 Login or Register to continue reading