loading…
SOC Incident handling
/api/mcp/srv-securityteam-socMCP enable + token are only for calling from an external client — the playground below needs neither.
Add IOC to blocking lists across security controls with expiration and justification
{
"type": "object",
"required": [
"ioc_value",
"ioc_type",
"justification"
],
"properties": {
"ioc_type": {
"enum": [
"ip",
"domain",
"url",
"hash_md5",
"hash_sha1",
"hash_sha256",
"email"
],
"type": "string"
},
"ioc_value": {
"type": "string"
},
"justification": {
"type": "string"
},
"block_duration": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"permanent"
],
"type": "string"
},
"security_controls": {
"type": "array",
"items": {
"enum": [
"firewall",
"proxy",
"edr",
"email_security"
],
"type": "string"
}
}
}
}Create new threat hunting query with KQL/SPL syntax and schedule for continuous monitoring
{
"type": "object",
"required": [
"hunt_name",
"query_language",
"query"
],
"properties": {
"query": {
"type": "string"
},
"schedule": {
"enum": [
"realtime",
"hourly",
"daily",
"weekly"
],
"type": "string"
},
"hunt_name": {
"type": "string"
},
"description": {
"type": "string"
},
"data_sources": {
"type": "array",
"items": {
"type": "string"
}
},
"query_language": {
"enum": [
"kql",
"spl",
"sql"
],
"type": "string"
}
}
}Escalate incident priority and notify on-call team with escalation reason
{
"type": "object",
"required": [
"incident_id",
"new_priority",
"escalation_reason"
],
"properties": {
"incident_id": {
"type": "string"
},
"new_priority": {
"enum": [
"p1",
"p2",
"p3",
"p4"
],
"type": "string"
},
"notify_oncall": {
"type": "boolean",
"default": true
},
"escalation_reason": {
"type": "string"
}
}
}Generate comprehensive IOC analysis report with prevalence, attribution, and recommended actions
{
"type": "object",
"required": [
"ioc_value"
],
"properties": {
"ioc_value": {
"type": "string"
},
"time_range": {
"enum": [
"24h",
"7d",
"30d",
"90d"
],
"type": "string"
},
"report_format": {
"enum": [
"json",
"pdf",
"stix"
],
"type": "string"
},
"include_context": {
"type": "boolean",
"default": true
}
}
}Retrieve asset security posture including vulnerabilities, exposure score, and recent security events
{
"type": "object",
"required": [],
"properties": {
"asset_id": {
"type": "string"
},
"hostname": {
"type": "string"
},
"ip_address": {
"type": "string"
}
}
}Retrieve complete incident record including timeline, artifacts, affected assets, and response actions
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"incident_id": {
"type": "string"
}
}
}List all active security incidents with filtering by priority, assignee, and incident type
{
"type": "object",
"required": [],
"properties": {
"status": {
"enum": [
"new",
"investigating",
"containment",
"eradication",
"recovery",
"closed"
],
"type": "string"
},
"priority": {
"enum": [
"p1",
"p2",
"p3",
"p4"
],
"type": "string"
},
"assignee_id": {
"type": "string"
},
"created_after": {
"type": "string",
"format": "date-time"
},
"incident_type": {
"enum": [
"malware",
"phishing",
"data_breach",
"insider_threat",
"ddos",
"unauthorized_access"
],
"type": "string"
}
}
}Search threat intelligence feeds for IOCs, TTPs, and threat actor information with confidence scoring
{
"type": "object",
"required": [],
"properties": {
"ioc_type": {
"enum": [
"ip",
"domain",
"url",
"hash_md5",
"hash_sha1",
"hash_sha256",
"email"
],
"type": "string"
},
"ioc_value": {
"type": "string",
"description": "IP, domain, hash, or other indicator"
},
"feed_sources": {
"type": "array",
"items": {
"type": "string"
}
},
"threat_actor": {
"type": "string"
},
"confidence_min": {
"type": "integer",
"maximum": 100,
"minimum": 0
}
}
}Search notable events in SIEM using SPL query with time range and severity filters, returns matching security events with metadata
{
"type": "object",
"required": [
"spl_query"
],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"status": {
"enum": [
"new",
"in_progress",
"resolved",
"closed",
"false_positive"
],
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"spl_query": {
"type": "string",
"description": "Splunk Processing Language query"
},
"latest_time": {
"type": "string",
"description": "End time in ISO format or relative time"
},
"earliest_time": {
"type": "string",
"description": "Start time in ISO format or relative time"
}
}
}Update investigation case status and add analyst notes with timestamp
{
"type": "object",
"required": [
"case_id",
"status"
],
"properties": {
"status": {
"enum": [
"new",
"assigned",
"investigating",
"pending",
"resolved",
"closed"
],
"type": "string"
},
"case_id": {
"type": "string"
},
"analyst_notes": {
"type": "string"
},
"resolution_code": {
"enum": [
"true_positive",
"false_positive",
"benign_positive",
"duplicate"
],
"type": "string"
}
}
}