loading…
No description
/api/mcp/srv-cloud-securityMCP enable + token are only for calling from an external client — the playground below needs neither.
Create new security investigation case with initial evidence, severity classification, and assignment to security team
{
"type": "object",
"required": [
"case_title",
"case_type",
"severity",
"description"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"case_type": {
"enum": [
"incident_response",
"threat_hunting",
"compliance_violation",
"insider_threat",
"data_breach"
],
"type": "string"
},
"case_title": {
"type": "string"
},
"assignee_id": {
"type": "string"
},
"description": {
"type": "string"
},
"initial_evidence": {
"type": "array",
"items": {
"type": "object",
"properties": {
"type": {
"enum": [
"alert",
"log_entry",
"artifact",
"ioc"
],
"type": "string"
},
"description": {
"type": "string"
},
"reference_id": {
"type": "string"
}
}
}
}
}
}Create security finding exception with justification and expiration for approved risk acceptance
{
"type": "object",
"required": [
"finding_id",
"justification",
"expiration_date",
"exception_type"
],
"properties": {
"finding_id": {
"type": "string"
},
"approver_id": {
"type": "string"
},
"justification": {
"type": "string"
},
"exception_type": {
"enum": [
"risk_accepted",
"false_positive",
"compensating_control"
],
"type": "string"
},
"expiration_date": {
"type": "string",
"format": "date"
}
}
}Create suppression rule to automatically suppress false positive alerts based on resource attributes, user context, or finding patterns
{
"type": "object",
"required": [
"rule_name",
"conditions"
],
"properties": {
"enabled": {
"type": "boolean",
"default": true
},
"rule_name": {
"type": "string",
"maxLength": 100
},
"conditions": {
"type": "object",
"required": [],
"properties": {
"regions": {
"type": "array",
"items": {
"type": "string"
}
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
},
"account_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"finding_type": {
"type": "array",
"items": {
"type": "string"
}
},
"resource_tags": {
"type": "object",
"additionalProperties": {
"type": "string"
}
}
}
},
"description": {
"type": "string",
"maxLength": 500
},
"expiration_date": {
"type": "string",
"format": "date"
}
}
}Execute automated incident response playbook for containment, investigation, and remediation actions
{
"type": "object",
"required": [
"playbook_id",
"incident_id"
],
"properties": {
"parameters": {
"type": "object",
"additionalProperties": true
},
"incident_id": {
"type": "string"
},
"playbook_id": {
"type": "string"
},
"execution_mode": {
"enum": [
"automatic",
"manual_approval",
"dry_run"
],
"type": "string"
},
"notification_channels": {
"type": "array",
"items": {
"enum": [
"email",
"slack",
"pagerduty",
"webhook"
],
"type": "string"
}
}
}
}Retrieve current security compliance posture summary with control status across specified frameworks and cloud accounts
{
"type": "object",
"required": [],
"properties": {
"frameworks": {
"type": "array",
"items": {
"enum": [
"cis",
"nist",
"pci",
"sox",
"gdpr",
"hipaa",
"iso27001"
],
"type": "string"
}
},
"cloud_account_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"control_categories": {
"type": "array",
"items": {
"enum": [
"access_management",
"data_protection",
"network_security",
"logging",
"encryption",
"incident_response"
],
"type": "string"
}
},
"include_remediation": {
"type": "boolean",
"default": false
}
}
}Retrieve detailed incident information including timeline, affected resources, and investigation notes by incident ID
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"incident_id": {
"type": "string"
},
"include_timeline": {
"type": "boolean",
"default": true
},
"include_artifacts": {
"type": "boolean",
"default": true
},
"include_related_alerts": {
"type": "boolean",
"default": false
}
}
}Retrieve detailed security incident information including timeline, affected resources, and investigation notes by incident ID
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"incident_id": {
"type": "string",
"pattern": "^INC-[0-9]{8}$"
},
"include_timeline": {
"type": "boolean",
"default": true
},
"include_artifacts": {
"type": "boolean",
"default": true
}
}
}Execute threat hunting query across cloud logs and telemetry using IOCs, TTPs, and behavioral patterns
{
"type": "object",
"required": [
"hunt_type"
],
"properties": {
"ttp_id": {
"type": "string",
"pattern": "^T[0-9]{4}(\\.[0-9]{3})?$",
"description": "MITRE ATT&CK technique ID"
},
"hunt_type": {
"enum": [
"ioc",
"ttp",
"behavioral",
"custom"
],
"type": "string"
},
"indicators": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"value"
],
"properties": {
"type": {
"enum": [
"ip",
"domain",
"hash",
"file_path",
"user_agent"
],
"type": "string"
},
"value": {
"type": "string"
},
"confidence": {
"enum": [
"high",
"medium",
"low"
],
"type": "string"
}
}
}
},
"custom_query": {
"type": "string"
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"cloudtrail",
"vpc_flow",
"dns",
"authentication",
"file_activity"
],
"type": "string"
}
},
"lookback_hours": {
"type": "integer",
"default": 24,
"maximum": 8760,
"minimum": 1
}
}
}Create and execute threat hunting query across cloud telemetry data using MITRE ATT&CK techniques and IOCs
{
"type": "object",
"required": [
"hunt_name",
"hunt_query",
"time_range"
],
"properties": {
"iocs": {
"type": "array",
"items": {
"type": "object",
"properties": {
"type": {
"enum": [
"ip",
"domain",
"hash",
"url",
"file_path"
],
"type": "string"
},
"value": {
"type": "string"
}
}
}
},
"end_time": {
"type": "string",
"format": "date-time"
},
"hunt_name": {
"type": "string"
},
"hunt_query": {
"type": "string"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d",
"custom"
],
"type": "string"
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"cloudtrail",
"vpc_flow",
"dns",
"auth_logs",
"container_logs"
],
"type": "string"
}
},
"mitre_techniques": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Analyze user behavior and access patterns across cloud services to detect anomalous activity and privilege abuse
{
"type": "object",
"required": [
"time_range"
],
"properties": {
"user_id": {
"type": "string"
},
"username": {
"type": "string"
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"activity_types": {
"type": "array",
"items": {
"enum": [
"authentication",
"resource_access",
"permission_changes",
"data_access",
"api_calls"
],
"type": "string"
}
},
"include_risk_score": {
"type": "boolean",
"default": true
},
"include_peer_analysis": {
"type": "boolean",
"default": false
}
}
}Retrieve active security alerts with filtering by status, assignee, and alert type
{
"type": "object",
"required": [],
"properties": {
"page": {
"type": "integer",
"default": 1,
"minimum": 1
},
"status": {
"type": "array",
"items": {
"enum": [
"new",
"investigating",
"acknowledged",
"resolved",
"false_positive"
],
"type": "string"
}
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
},
"page_size": {
"type": "integer",
"default": 50,
"maximum": 500,
"minimum": 10
},
"alert_type": {
"type": "array",
"items": {
"enum": [
"malware",
"data_exfiltration",
"privilege_escalation",
"lateral_movement",
"reconnaissance",
"persistence"
],
"type": "string"
}
},
"assignee_id": {
"type": "string"
}
}
}List security findings with pagination, filtering by compliance framework, resource type, and remediation status
{
"type": "object",
"required": [],
"properties": {
"page": {
"type": "integer",
"default": 1,
"minimum": 1
},
"status": {
"type": "array",
"items": {
"enum": [
"open",
"suppressed",
"resolved",
"in_progress"
],
"type": "string"
}
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
},
"page_size": {
"type": "integer",
"default": 50,
"maximum": 100,
"minimum": 1
},
"resource_type": {
"type": "array",
"items": {
"enum": [
"s3_bucket",
"ec2_instance",
"iam_role",
"security_group",
"lambda_function",
"rds_instance",
"cloudtrail"
],
"type": "string"
}
},
"compliance_framework": {
"type": "array",
"items": {
"enum": [
"cis",
"nist",
"pci-dss",
"sox",
"gdpr",
"hipaa"
],
"type": "string"
}
}
},
"additionalProperties": false
}List security posture scores and compliance status across cloud accounts and regions
{
"type": "object",
"required": [],
"properties": {
"region": {
"type": "array",
"items": {
"type": "string"
}
},
"account_id": {
"type": "array",
"items": {
"type": "string"
}
},
"include_trends": {
"type": "boolean",
"default": false
},
"posture_score_min": {
"type": "integer",
"maximum": 100,
"minimum": 0
},
"compliance_framework": {
"type": "array",
"items": {
"enum": [
"SOC2",
"PCI-DSS",
"HIPAA",
"CIS",
"NIST"
],
"type": "string"
}
}
}
}List active threat detections and security alerts with filtering by detection type, threat actor, and confidence level
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50,
"maximum": 500,
"minimum": 1
},
"status": {
"type": "array",
"items": {
"enum": [
"active",
"investigating",
"resolved",
"false_positive"
],
"type": "string"
}
},
"account_id": {
"type": "array",
"items": {
"type": "string"
}
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"threat_actor": {
"type": "string"
},
"detection_type": {
"type": "array",
"items": {
"enum": [
"malware",
"data_exfiltration",
"privilege_escalation",
"lateral_movement",
"persistence",
"command_control"
],
"type": "string"
}
},
"confidence_level": {
"type": "array",
"items": {
"enum": [
"high",
"medium",
"low"
],
"type": "string"
}
}
}
}Search security events across cloud infrastructure using KQL or custom filters with time range and severity filtering
{
"type": "object",
"required": [
"query",
"time_range"
],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 10000,
"minimum": 1
},
"query": {
"type": "string",
"description": "KQL query string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
}
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"custom"
],
"type": "string"
},
"cloud_provider": {
"type": "array",
"items": {
"enum": [
"aws",
"azure",
"gcp",
"multi-cloud"
],
"type": "string"
}
}
}
}Query cloud security logs using KQL syntax across CloudTrail, VPC Flow Logs, and security service logs
{
"type": "object",
"required": [
"kql_query",
"time_range"
],
"properties": {
"limit": {
"type": "integer",
"default": 1000,
"maximum": 10000,
"minimum": 1
},
"region": {
"type": "array",
"items": {
"type": "string"
}
},
"kql_query": {
"type": "string"
},
"account_id": {
"type": "array",
"items": {
"type": "string"
}
},
"time_range": {
"type": "object",
"required": [
"start",
"end"
],
"properties": {
"end": {
"type": "string",
"format": "date-time"
},
"start": {
"type": "string",
"format": "date-time"
}
}
},
"log_sources": {
"type": "array",
"items": {
"enum": [
"cloudtrail",
"vpc_flow",
"guardduty",
"security_hub",
"config",
"cloudwatch"
],
"type": "string"
}
}
}
}Execute automated remediation action for security finding such as isolating resources, revoking permissions, or applying security policies
{
"type": "object",
"required": [
"finding_id",
"remediation_action"
],
"properties": {
"finding_id": {
"type": "string"
},
"auto_approve": {
"type": "boolean",
"default": false
},
"remediation_notes": {
"type": "string",
"maxLength": 1000
},
"remediation_action": {
"enum": [
"isolate_instance",
"revoke_permissions",
"apply_security_group",
"enable_encryption",
"delete_resource",
"quarantine_s3_object"
],
"type": "string"
},
"notify_stakeholders": {
"type": "boolean",
"default": true
}
}
}Execute compliance scan against cloud resources for specified frameworks and generate assessment report
{
"type": "object",
"required": [
"compliance_framework"
],
"properties": {
"scan_type": {
"enum": [
"full",
"incremental",
"targeted"
],
"type": "string"
},
"account_id": {
"type": "array",
"items": {
"type": "string"
}
},
"resource_scope": {
"type": "array",
"items": {
"enum": [
"compute",
"storage",
"network",
"iam",
"logging",
"encryption"
],
"type": "string"
}
},
"notification_email": {
"type": "array",
"items": {
"type": "string",
"format": "email"
}
},
"compliance_framework": {
"enum": [
"SOC2",
"PCI-DSS",
"HIPAA",
"CIS",
"NIST"
],
"type": "string"
}
}
}Execute security posture scan across cloud resources to identify misconfigurations and compliance violations
{
"type": "object",
"required": [
"scan_type"
],
"properties": {
"scan_name": {
"type": "string"
},
"scan_type": {
"enum": [
"full",
"incremental",
"targeted"
],
"type": "string"
},
"cloud_accounts": {
"type": "array",
"items": {
"type": "string"
}
},
"resource_types": {
"type": "array",
"items": {
"enum": [
"storage",
"compute",
"network",
"iam",
"database",
"containers"
],
"type": "string"
}
},
"notify_on_completion": {
"type": "boolean",
"default": true
},
"compliance_frameworks": {
"type": "array",
"items": {
"enum": [
"cis",
"nist",
"pci",
"sox",
"gdpr",
"hipaa"
],
"type": "string"
}
}
}
}Initiate on-demand security scan of cloud resources with configurable compliance checks and vulnerability assessment
{
"type": "object",
"required": [
"scan_type"
],
"properties": {
"scan_name": {
"type": "string",
"maxLength": 100
},
"scan_type": {
"enum": [
"compliance",
"vulnerability",
"configuration",
"full"
],
"type": "string"
},
"resource_scope": {
"type": "object",
"required": [],
"properties": {
"regions": {
"type": "array",
"items": {
"type": "string"
}
},
"account_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"resource_tags": {
"type": "object",
"additionalProperties": {
"type": "string"
}
}
}
},
"compliance_frameworks": {
"type": "array",
"items": {
"enum": [
"cis",
"nist",
"pci-dss",
"sox",
"gdpr",
"hipaa"
],
"type": "string"
}
}
}
}Search security findings across cloud resources using filters for severity, compliance frameworks, and resource types
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 1000,
"minimum": 1
},
"query": {
"type": "string",
"description": "Search query string"
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
}
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"90d"
],
"type": "string"
},
"resource_type": {
"type": "array",
"items": {
"enum": [
"ec2",
"s3",
"rds",
"lambda",
"iam",
"vpc",
"cloudtrail"
],
"type": "string"
}
},
"cloud_provider": {
"type": "array",
"items": {
"enum": [
"aws",
"azure",
"gcp"
],
"type": "string"
}
},
"compliance_framework": {
"type": "array",
"items": {
"enum": [
"SOC2",
"PCI-DSS",
"HIPAA",
"CIS",
"NIST"
],
"type": "string"
}
}
}
}Update alert status, assign investigator, add notes, and set priority for security alert triage workflow
{
"type": "object",
"required": [
"alert_id"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"notes": {
"type": "string"
},
"status": {
"enum": [
"new",
"investigating",
"acknowledged",
"resolved",
"false_positive"
],
"type": "string"
},
"alert_id": {
"type": "string"
},
"priority": {
"enum": [
"p0",
"p1",
"p2",
"p3",
"p4"
],
"type": "string"
},
"assignee_id": {
"type": "string"
}
}
}Update security alert status, assign analyst, and add triage notes for incident response workflow
{
"type": "object",
"required": [
"alert_id",
"status"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"status": {
"enum": [
"new",
"investigating",
"confirmed",
"false_positive",
"resolved"
],
"type": "string"
},
"alert_id": {
"type": "string"
},
"priority": {
"enum": [
"p1",
"p2",
"p3",
"p4"
],
"type": "string"
},
"assigned_to": {
"type": "string",
"description": "analyst email or username"
},
"triage_notes": {
"type": "string",
"maxLength": 2000
}
}
}Update security incident status and assign to security team members for investigation and response
{
"type": "object",
"required": [
"incident_id",
"status"
],
"properties": {
"notes": {
"type": "string"
},
"status": {
"enum": [
"new",
"investigating",
"contained",
"resolved",
"closed"
],
"type": "string"
},
"priority": {
"enum": [
"p0",
"p1",
"p2",
"p3",
"p4"
],
"type": "string"
},
"assignee_id": {
"type": "string"
},
"incident_id": {
"type": "string"
}
}
}