The evidence is already there. The problem is finding it fast enough.
Search live operational and security logs across configured Windows and Linux servers and produce re-checkable evidence references for AI-assisted investigation.
The Logs MCP Server searches the files that already exist on the estate. It is useful when evidence is distributed across application servers, integration servers, web tiers, batch systems and Linux hosts — especially where continuous SIEM ingestion would be unnecessary or expensive.
Search first, read selectively
Rather than stream whole logs to a model, the tools search across configured roots and let the model read only the matching evidence and surrounding context.
Security evidence profile
The security profile adds SearchEvidence and GetEvidence. A cited record includes server, path, file identity, line number, byte offset, observed time when available, search id and evidence hash.
JD Edwards is a natural example
An incident may cross Enterprise Server, AIS, WebLogic, batch, interface and operating-system logs. The same investigation can correlate one user, source address, request id or time window across those systems.
Re-check, don't merely trust the summary
If the file rotated or the source line changed after the investigation, re-verification can say so. These are reproducible evidence references with integrity checks, not a claim of forensic disk imaging.