{
  "type": "mcp-server",
  "slug": "ie-change-attribution",
  "name": "Tenable IE Change Attribution",
  "author": "hatumus",
  "description": "Names the actor behind Tenable IE's Active Directory findings by correlating them with DC Security logs, via MCP.",
  "github_url": "https://github.com/hatumus/tenable-ie-change-attribution",
  "license": "MIT",
  "tier": "contributed",
  "tags": [
    "active-directory",
    "identity-exposure",
    "incident-response",
    "threat-hunting",
    "attribution",
    "windows-event-log",
    "mcp"
  ],
  "integrations": [
    "Tenable"
  ],
  "domains": [
    "identity-access",
    "security-operations"
  ],
  "date_added": "2026-09-02",
  "last_reviewed": "2026-09-03",
  "transport": "stdio",
  "runtime": "python",
  "auth_method": "api-key",
  "compatible_clients": [
    "Claude Code",
    "Claude Desktop"
  ],
  "tools_exposed": [
    {
      "name": "who_caused_deviances",
      "description": "Pull Tenable IE deviances (IoE security findings) and attribute each to the actor in the DC Security log."
    },
    {
      "name": "attribute_ie_window",
      "description": "Pull IE Trail Flow changes in a time range and attribute each to the DC actor who made them, paginating past the API's 500-event page cap."
    },
    {
      "name": "attribute_change",
      "description": "Attribute a single AD change (by DN / objectSid / objectGUID / sAMAccountName + timestamp) to its actor."
    },
    {
      "name": "attribute_trailflow_event",
      "description": "Attribute a single Trail Flow event by its numeric event id to the DC-log actor who made it."
    },
    {
      "name": "query_dc_log",
      "description": "Query the DC Security event log directly over WinRM, bypassing Tenable IE, for ad-hoc investigation."
    }
  ],
  "resources_exposed": [],
  "prompts_exposed": [],
  "repo": {
    "found": true,
    "archived": false,
    "pushed_at": "2026-08-28T11:16:50Z",
    "stars": 3,
    "forks": 0,
    "open_issues": 0,
    "owner_type": "user",
    "language": "Python",
    "checked_at": "2026-11-05T20:35:15.821Z"
  },
  "url": "https://exchange.tenable.com/mcp-servers/ie-change-attribution",
  "json_url": "https://exchange.tenable.com/api/mcp-servers/ie-change-attribution.json",
  "markdown_url": "https://exchange.tenable.com/mcp-servers/ie-change-attribution.md",
  "source_url": "https://github.com/tenable/cyberagents-exchange/blob/main/mcp-servers/ie-change-attribution.md"
}