loading…
Tools for analyzing network traffic, firewall rules, ports, services, DNS activity, and suspicious connections. Support exposure detection, traffic investigation, policy checks, and threat containment.
/api/mcp/srv-network-securityMCP enable + token are only for calling from an external client — the playground below needs neither.
Add IOC to blocklist across security controls with expiration and justification
{
"type": "object",
"required": [
"indicator",
"indicator_type",
"block_scope",
"justification"
],
"properties": {
"case_id": {
"type": "string"
},
"indicator": {
"type": "string"
},
"expires_at": {
"type": "string",
"format": "date-time"
},
"block_scope": {
"type": "array",
"items": {
"enum": [
"firewall",
"proxy",
"email",
"endpoint",
"dns"
],
"type": "string"
}
},
"justification": {
"type": "string"
},
"indicator_type": {
"enum": [
"ip",
"domain",
"url",
"file_hash",
"email"
],
"type": "string"
}
}
}Create new investigation case from alerts, events, or manual initiation with initial classification
{
"type": "object",
"required": [
"title",
"priority",
"category"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"title": {
"type": "string"
},
"category": {
"enum": [
"malware",
"phishing",
"data_exfiltration",
"insider_threat",
"policy_violation",
"other"
],
"type": "string"
},
"priority": {
"enum": [
"p1",
"p2",
"p3",
"p4"
],
"type": "string"
},
"alert_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"assigned_to": {
"type": "string"
},
"description": {
"type": "string"
}
}
}Fetch detailed alert information by alert ID including enrichment data and investigation timeline
{
"type": "object",
"required": [
"alert_id"
],
"properties": {
"alert_id": {
"type": "string"
},
"include_timeline": {
"type": "boolean",
"default": true
},
"include_enrichment": {
"type": "boolean",
"default": true
}
}
}Retrieve asset information and risk context including criticality, vulnerabilities, and recent activity
{
"type": "object",
"required": [],
"properties": {
"asset_id": {
"type": "string"
},
"hostname": {
"type": "string"
},
"days_back": {
"type": "integer",
"default": 30
},
"ip_address": {
"type": "string"
},
"include_recent_alerts": {
"type": "boolean",
"default": true
},
"include_vulnerabilities": {
"type": "boolean",
"default": true
}
}
}Retrieve incident details by incident ID including timeline, artifacts, and current assignment
{
"type": "object",
"required": [
"incident_id"
],
"properties": {
"incident_id": {
"type": "string"
},
"include_timeline": {
"type": "boolean",
"default": true
},
"include_artifacts": {
"type": "boolean",
"default": true
}
}
}Retrieve threat intelligence for IOC including reputation, attribution, and related campaigns
{
"type": "object",
"required": [
"indicator",
"indicator_type"
],
"properties": {
"sources": {
"type": "array",
"items": {
"enum": [
"internal",
"commercial",
"open_source",
"government"
],
"type": "string"
}
},
"indicator": {
"type": "string"
},
"indicator_type": {
"enum": [
"ip",
"domain",
"url",
"file_hash",
"email"
],
"type": "string"
},
"include_context": {
"type": "boolean",
"default": true
}
}
}Execute threat hunt using IOCs, YARA rules, or custom hunt queries across endpoints and network data
{
"type": "object",
"required": [
"hunt_type"
],
"properties": {
"query": {
"type": "string"
},
"hunt_type": {
"enum": [
"ioc",
"yara",
"custom",
"sigma"
],
"type": "string"
},
"custom_end": {
"type": "string",
"format": "date-time"
},
"indicators": {
"type": "array",
"items": {
"type": "string"
}
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d",
"custom"
],
"type": "string"
},
"custom_start": {
"type": "string",
"format": "date-time"
},
"target_scope": {
"type": "array",
"items": {
"enum": [
"endpoints",
"network",
"email",
"cloud"
],
"type": "string"
}
}
}
}Execute threat hunting query across network data using YARA rules or custom detection logic
{
"type": "object",
"required": [
"hunt_name",
"query_type",
"query_content"
],
"properties": {
"hunt_name": {
"type": "string"
},
"custom_end": {
"type": "string"
},
"query_type": {
"enum": [
"yara",
"sigma",
"custom_spl",
"kql"
],
"type": "string"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"custom"
],
"type": "string"
},
"custom_start": {
"type": "string"
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"network_traffic",
"dns_logs",
"proxy_logs",
"endpoint_data",
"email_logs"
],
"type": "string"
}
},
"query_content": {
"type": "string"
}
}
}List network assets with filtering by asset type, criticality, and vulnerability status
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"subnet": {
"type": "string"
},
"asset_type": {
"type": "array",
"items": {
"enum": [
"server",
"workstation",
"mobile",
"iot",
"network_device",
"cloud_resource"
],
"type": "string"
}
},
"criticality": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
},
"vulnerability_status": {
"type": "array",
"items": {
"enum": [
"vulnerable",
"patched",
"unknown"
],
"type": "string"
}
}
}
}List active detections with filtering by rule type, status, and time range
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50
},
"status": {
"type": "array",
"items": {
"enum": [
"active",
"suppressed",
"disabled",
"tuning"
],
"type": "string"
}
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
},
"rule_type": {
"type": "array",
"items": {
"enum": [
"signature",
"anomaly",
"behavioral",
"correlation"
],
"type": "string"
}
},
"last_triggered_after": {
"type": "string",
"format": "date-time"
}
}
}Retrieve threat indicators with optional filtering by type, confidence, and TLP marking
{
"type": "object",
"required": [],
"properties": {
"tlp": {
"enum": [
"red",
"amber",
"green",
"white"
],
"type": "string"
},
"limit": {
"type": "integer",
"default": 100
},
"offset": {
"type": "integer",
"default": 0
},
"confidence": {
"enum": [
"high",
"medium",
"low"
],
"type": "string"
},
"indicator_type": {
"type": "array",
"items": {
"enum": [
"ip",
"domain",
"url",
"hash",
"email",
"file"
],
"type": "string"
}
}
}
}Search security events using SPL query language with time range and severity filters
{
"type": "object",
"required": [
"spl"
],
"properties": {
"spl": {
"type": "string",
"description": "Splunk Processing Language query"
},
"latest": {
"type": "string",
"description": "End time (ISO 8601 or relative like now)"
},
"earliest": {
"type": "string",
"description": "Start time (ISO 8601 or relative like -24h)"
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
}
}
}
}Search security events using KQL query language with time range and severity filters
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 10000
},
"query": {
"type": "string",
"description": "KQL query string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
}
},
"start_time": {
"type": "string",
"format": "date-time"
}
}
}Update alert status, assign analyst, and add triage notes for security alerts
{
"type": "object",
"required": [
"alert_id",
"status"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"notes": {
"type": "string"
},
"status": {
"enum": [
"new",
"investigating",
"resolved",
"false_positive",
"duplicate"
],
"type": "string"
},
"alert_id": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"assigned_to": {
"type": "string"
}
}
}Change case status and add resolution notes for incident response workflow
{
"type": "object",
"required": [
"case_id",
"status"
],
"properties": {
"status": {
"enum": [
"new",
"in_progress",
"escalated",
"resolved",
"closed",
"false_positive"
],
"type": "string"
},
"case_id": {
"type": "string"
},
"analyst_id": {
"type": "string"
},
"resolution_notes": {
"type": "string"
}
}
}