loading…

Endpoint_Security

Tools for investigating endpoints, processes, files, connections, EDR alerts, and suspicious activity. Support host isolation, process investigation, IOC searches, and incident containment.

Generator controls

|/api/mcp/srv-endpoint-security

MCP enable + token are only for calling from an external client — the playground below needs neither.

Tools (9)

endpoint__get_detectionedit →

Retrieve detailed information for a specific detection by detection ID

{
  "type": "object",
  "required": [
    "detection_id"
  ],
  "properties": {
    "detection_id": {
      "type": "string",
      "description": "Unique detection identifier"
    }
  }
}

endpoint__get_host_detailsedit →

Get comprehensive host information including installed agents, policies, and recent activity

{
  "type": "object",
  "required": [
    "host_id"
  ],
  "properties": {
    "host_id": {
      "type": "string",
      "description": "Unique host identifier"
    },
    "event_limit": {
      "type": "integer",
      "default": 10,
      "maximum": 100,
      "minimum": 1
    },
    "include_events": {
      "type": "boolean",
      "default": false
    }
  }
}

endpoint__hunt_threatsedit →

Execute threat hunting query across endpoint telemetry with IOC matching

{
  "type": "object",
  "required": [
    "hunt_query"
  ],
  "properties": {
    "iocs": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Indicators of compromise to search for"
    },
    "hunt_query": {
      "type": "string",
      "description": "Threat hunting query syntax"
    },
    "time_range": {
      "enum": [
        "1h",
        "6h",
        "24h",
        "7d",
        "30d",
        "90d"
      ],
      "type": "string",
      "default": "24h"
    },
    "host_groups": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Specific host groups to target"
    }
  }
}

endpoint__isolate_host

Scenarios (1)

Create a scenario for this task →

Examine EDR alerts, running processes, files, network connections, and indicators on the affected endpoint. Determine compromise scope and isolate the host when sufficient evidence exists.

{
  "type": "object",
  "required": [
    "host_id",
    "reason"
  ],
  "properties": {
    "reason": {
      "type": "string",
      "description": "Justification for isolation"
    },
    "host_id": {
      "type": "string",
      "description": "Unique host identifier"
    },
    "notify_user": {
      "type": "boolean",
      "default": true
    }
  }
}