Get Started
What We Do
How We Do It
Resources
Company
Partners
Login
Get Started
What we do
How we do it
Resources
Company
Partners
Get Started
What We Do
CONTROLLED AUTONOMY SECOPS
Atlas Platform

Connects to any signal across any vendor stack and powers adaptive AI Operatives that expose, detect, and neutralize cyberattacks.

 Atlas Operations Center

See what our SOC sees, review investigations, and see how we are protecting your business.

 Technology Integrations

Atlas connects to any signal across your current security tools. Whatever you're running, we're running with you.
EXPERT-VALIDATED DEFENSE
24/7 Security Operations Center

Extend your team with immediate expertise, hands-on remediation, and the human accountability layer that boards, regulators, and cyber insurers require.

 Threat Response Unit

Proactive threat intelligence, original threat research and a world-class team of seasoned industry veterans.

 Response and Remediation

Pairs machine-speed containment with human judgment, delivering full threat response that's policy-bounded, reversible, and explainable.
ESENTIRE SERVICES
Managed Detection and Response

MDR that moves first, multi-signal attack surface coverage, and 24/7 Elite threat hunters working as one continuous security program across any vendor stack.
All-in-One eSentire MDR MDR for Microsoft
Digital Forensics and Incident Response

Get unlimited Incident Response with threat suppression guarantee- anytime, anywhere.
Autonomous Pen Testing & Continuous Threat Exposure Management (CTEM)

Atlas Preempt deploys AI Operatives to continuously validate attack paths exposing attacker targets of opportunity before they take advantage.
How We Do It
MDR Packages and 24/7 Protection
MDR Pricing and Packages

Flexible MDR pricing and packages that fit your unique security requirements.
Atlas Essentials

Entry level foundational MDR coverage
Atlas Advanced

Comprehensive Next Level eSentire MDR
Atlas Complete

Next Level eSentire MDR with Cyber Risk Advisors to continuously advance your security program
Explore MDR Packages Build Your MDR Package
24/7 Coverage
Endpoint
Network
Log
Cloud
Identity
INDUSTRIES
Insurance Construction Finance Legal Manufacturing Private Equity Healthcare Retail Food Supply Government and Education Automotive Dealerships
USE CASES
Ransomware

Stop ransomware before it spreads.

 Identity Response

Stop identity-based cyberattacks.

 Zero Day Attacks

Detect and respond to zero-day exploits.

 Cybersecurity Compliance

Meet regulatory compliance mandates.

 Third-Party Risk

Defend third-party and supply chain risk.

 Cloud Misconfiguration

End misconfigurations and policy violations.

 Cyber Risk

Adopt a risk-based security approach.

 Mid-Market Security

Mid-market security essentials to prioritize.

 Sensitive Data Security

Protect your most sensitive data.

 Cyber Insurance

Meet insurability requirements with MDR.

 Cyber Threat Intelligence

Operationalize cyber threat intelligence.

 Security Leadership

Build a proven security program.
Resources
Resources
Resource Library Video Library Case Studies Compare MDR Vendors TRU Intelligence Center Monthly Threat Intelligence Briefings Cybersecurity Tools Cybersecurity Glossary Real vs. Fake MDR Blogs Security Advisories
SECURITY ADVISORIES
Aug 04, 2026 N-central Vulnerability (CVE-2026-18577) Under Exploitation

On August 2nd, 2026, N-able disclosed CVE-2026-18577, an authentication bypass vulnerability impacting N-central instances. The vulnerability is due to an incomplete patch that was released…

Read More
Jul 29, 2026 PoC Exploit Code Released for Check Point SmartConsole Zero-Day Vulnerability (CVE-2026-16232)

On July 28th, 2026, Rapid7 Labs published technical details and Proof-of-Concept (PoC) exploit code for CVE-2026-16232 (CVSS: 9.1), a critical authentication bypass vulnerability in the…

Read More
View Advisories
From The Blog
Aug 25, 2026 Response Orchestration: Automated Action on Your Terms
Read More
Aug 19, 2026 Malware-as-a-Service Cocktail: ErrTraffic and Cruciferra - Killing Your…
Read More
Aug 05, 2026 eSentire Announces New Partnership with Sublime Security
Read More
VIEW ARTICLES
Company
ABOUT ESENTIRE

eSentire is a leader in Controlled Autonomy SecOps, protecting 2,000+ organizations across 35+ industries around the world. Founded in 2001, the company’s Controlled Autonomy SecOps operating model pairs agentic AI operatives with engineered human-judgment controls, delivering expert-depth security outcomes at machine speed without ceding accountability to opaque automation.

About Us Leadership Careers Event Calendar → Newsroom → Aston Villa Football Club →
EVENT CALENDAR
Aug
23
ILTACON
Aug
27
Salt Lake City FutureCon
Sep
15
CYBER.SEC.CON
Sep
15
September TRU Intelligence Briefing
Sep
20
TribalNet Annual Conference
View Calendar
LATEST PRESS RELEASE
Jul 29, 2026 eSentire Unifies Detection, Response, and Remediation with New Atlas Response, Email, and Patch Management Read More
View Newsroom
OUR PARTNERSHIPS
Aston Villa Football Club

AVFC takes its cyber protection to the Next Level with eSentire as its official cybersecurity partner.

Learn More
Partners
PARTNER PROGRAM

Apply to become an e3 ecosystem partner with eSentire today.
APPLY NOW

Sign in to the Partner Portal to access exclusive resources, campaigns, training, sales tools, and support.
LOGIN NOW
Search

Search our site

Quick Links
ALL-IN-ONE ESENTIRE MDR

Multi-Signal MDR with 300+ technology integrations to support your existing investments.
24/7 SOC SUPPORT

24/7 SOC-as-a-Service with unlimited threat hunting and incident handling.
MDR PRICING AND PACKAGES

We offer three flexible MDR pricing packages that can be customized to your unique needs.
TRU INTELLIGENCE CENTER

The latest security advisories, blogs, reports, industry publications and webinars published by TRU.
MDR VENDOR COMPARISONS

Compare eSentire to other Managed Detection and Response vendors to see how we stack up against the competition.
MDR CASE STUDIES

See why 2000+ organizations globally have chosen eSentire for their MDR Solution.
Get Started
Get Started
Build A Quote
Become A Partner
Breached?
Call Us Now
Home What We Do Security Operations Platform Atlas MCP

ESENTIRE + ANTHROPIC

Atlas, now in Claude.

eSentire customers can connect Atlas directly to Claude — investigating findings, querying their environment, and acting on tickets in natural language.

It's the next step in the eSentire–Anthropic partnership: the same Claude that already powers 120,000+ autonomous investigations behind Atlas, now available to your team as an interface to your own MDR data.

Talk to sales

The Partnership

eSentire + Anthropic Atlas MCP eSentire + Anthropic Atlas MCP

Two sides of the same partnership.

Claude runs inside Atlas. The Atlas MCP turns the relationship around — bringing your Atlas data into Claude. Same partnership, two complementary surfaces.

— The engine

Claude inside Atlas

Behind the scenes, Atlas already uses Claude to run autonomous threat investigations across thousands of environments — averaging 44 tool calls per case, with above-90% alignment with senior SOC experts and 99.96% ransomware containment before encryption.

That work happens automatically, without anyone in your team having to ask.

120K+ Autonomous investigations / 12 mo
99.96% Ransomware containment

Read the full case study

— The interface

Atlas inside Claude

The Atlas MCP connector turns the relationship around. When your team connects Atlas to Claude Desktop or Claude Code, Claude can query your MDR environment directly: pull findings, look up assets, surface vulnerabilities, manage tickets.

It's your data, your permissions, surfaced through the chat your team already uses.

16 Purpose-built tools
OAuth 2.0 via Okta · RBAC-aware

Capabilities

What you can do with Atlas in Claude.

Three high-value flows your team will reach for first. Each example exercises real tools the MCP exposes today.

01 / Investigate

Investigate findings, fast.

Pull open critical findings, drill into signal-level detail, and identify affected assets — all in one conversation.

"Show me the open critical findings from the last 7 days. For the highest-severity one, pull the full signal data and tell me which assets are affected."

02 / Manage

Vulnerabilities and patches.

Surface unpatched critical vulnerabilities across your environment, group them by host, and see which fixes are available now.

"List my unpatched critical vulnerabilities from the last MVS scan, grouped by host, and show me which ones have missing patches available."

03 / Act

Triage and act on tickets.

Review case status, read the latest analyst comments, and create or update tickets without switching tools.

"Open ticket CS-12345 — summarize current status, show me the latest comments, and add a follow-up ticket for the remediation work."

Built for security teams

Faster triage. Trusted access. No new platform.

Faster triage,
deeper context

Cut the time between "alert lands" and "I understand what's happening." Atlas MCP gives Claude live access to findings, signal data, and asset context — so analysts spend less time pivoting and more time deciding.

Your data,
your controls

OAuth 2.0 via Okta. Customer-scoped access. The MCP only sees what your authenticated user is permitted to see — the same RBAC model as the Atlas platform.

No new platform
to learn

It's your Atlas data, surfaced through Claude. Pair the prompts and workflows your team already uses with Claude's reasoning, document handling, and analysis.

Architecture

How it works.

The connection

The Atlas MCP server runs at api.esentire.com/mcp/rpc and uses the Model Context Protocol (MCP) over Streamable HTTP. When you connect Claude to Atlas, Claude can call any of 16 purpose-built tools that read from — and in some cases write to — your eSentire environment. Authentication is OAuth 2.0 via Okta; data flows directly between Claude and eSentire's APIs over your authenticated session, with all infrastructure hosted in eSentire's us-west-2 (Oregon) AWS region.

Reference

Available tools.

Sixteen purpose-built tools split across four functional areas. Read tools surface data; write tools always prompt for confirmation.

Findings & signals

3 read-only
  • list_findings Search and filter open or closed findings
  • get_finding Full detail for a specific finding
  • get_signal_data Signal-level data behind a finding

Assets & vulnerabilities

5 read-only
  • list_assets Asset inventory, filterable by attributes
  • get_asset Single-asset deep-dive
  • list_vulnerabilities Vulns from MVS scans
  • get_vulnerability CVSS, hosts, exploitability
  • list_missing_patches Patches available but not applied

Support tickets

5 read 2 write
  • list_tickets Search support tickets
  • get_ticket Full ticket detail
  • get_ticket_comments Latest analyst comments
  • get_ticket_attachments Attached files
  • get_ticket_options Available case fields
  • create_ticket Open a new case (confirms first)
  • update_ticket Update status, comments (confirms first)

Findings actions

1 write
  • update_finding Close, change status, add notes (confirms first)

Security & privacy

Your data, your controls.

Authentication

OAuth 2.0 via Okta. Tokens are scoped to the authenticated user and follow the same RBAC permissions as the Atlas platform.

Data flow

All requests go directly from your Claude client to eSentire's API. No customer data is stored by the MCP server beyond the lifetime of the request.

What's accessed

Only the data your authenticated user is permitted to see — findings, assets, vulnerabilities, tickets, and signals tied to your tenant.

What's not accessed

The MCP does not query Claude's memory, conversation history, or files you've uploaded to Claude.

Common questions.

Who can use the Atlas MCP?

Existing eSentire customers with active API access. If you're not yet a customer, talk to sales.

Which Claude products work with it?

Claude Desktop and Claude Code today. Once accepted into Anthropic's Connectors Directory, it will also be available for users on connector-supported Claude.ai plans.

Will Atlas MCP work with other AI clients besides Claude?

MCP is an open standard, so technically any MCP-compatible client can connect. Our supported launch surface is Claude — that's where the work has been validated end-to-end and where customers will get the best experience day one. We'll evaluate additional clients based on customer demand and our ability to support them at the same quality bar.

How is this different from the Claude that powers Atlas?

They're complementary. Claude inside Atlas runs autonomous investigations on every signal — that's been live across our customer base for months. The Atlas MCP is the other direction: it gives your team a way to query Atlas data and act on it from inside their own Claude environment. Same partnership, two different surfaces.

What happens if my Okta access changes?

The MCP respects your eSentire RBAC permissions. If your access changes in Okta, the MCP reflects it on the next request.

Can Claude make changes I didn't approve?

No. Write tools (creating or updating findings and tickets) always prompt you for confirmation before executing.

Where is the data hosted?

The Atlas MCP runs in eSentire's eu-west-1 (Ireland) AWS region behind API Gateway.

Ready to connect Atlas to Claude?

Bring the same Claude that already powers Atlas's autonomous investigations into your team's daily workflow.

TALK TO AN EXPERT
ARE YOU EXPERIENCING A SECURITY INCIDENT OR HAVE YOU BEEN BREACHED?
Call 1-866-579-2200
The Proven Choice for
Managed Detection and Response
GET STARTED → PARTNER LOGIN →
Sales and
Customer Support
NORTH AMERICA 1-866-579-2200 EMEA (0)8000-443242 ANZ/APAC 1-519-651-2200
What we do
How we do it
Industries
Use Cases
Resources
Tools
Company

2026 eSentire, Inc. All Rights Reserved.