loading…
No description
/api/mcp/srv-network-security-2MCP enable + token are only for calling from an external client — the playground below needs neither.
Add indicator to block list across security controls, creates enforcement rules in firewalls and proxies
{
"type": "object",
"required": [
"indicator_value",
"indicator_type",
"reason"
],
"properties": {
"reason": {
"type": "string"
},
"block_duration": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"permanent"
],
"type": "string"
},
"indicator_type": {
"enum": [
"ip",
"domain",
"url",
"hash"
],
"type": "string"
},
"indicator_value": {
"type": "string"
},
"enforcement_points": {
"type": "array",
"items": {
"enum": [
"firewall",
"proxy",
"dns",
"endpoint"
],
"type": "string"
}
},
"override_whitelist": {
"type": "boolean",
"default": false
}
}
}Create new incident case with title, severity, assigned analyst, and initial evidence artifacts
{
"type": "object",
"required": [
"title",
"severity"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"title": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"artifacts": {
"type": "array",
"items": {
"type": "object",
"properties": {
"type": {
"enum": [
"ip",
"domain",
"hash",
"event_id"
],
"type": "string"
},
"value": {
"type": "string"
}
}
}
},
"assigned_to": {
"type": "string",
"description": "Analyst username"
},
"description": {
"type": "string"
}
}
}Generate security report with metrics, top threats, and case summaries for specified time period and report type
{
"type": "object",
"required": [
"report_type",
"start_date",
"end_date"
],
"properties": {
"format": {
"enum": [
"pdf",
"html",
"json"
],
"type": "string",
"default": "pdf"
},
"end_date": {
"type": "string",
"format": "date"
},
"start_date": {
"type": "string",
"format": "date"
},
"report_type": {
"enum": [
"executive_summary",
"threat_intelligence",
"incident_response",
"compliance"
],
"type": "string"
},
"time_period": {
"enum": [
"daily",
"weekly",
"monthly",
"quarterly"
],
"type": "string"
},
"include_charts": {
"type": "boolean",
"default": true
}
}
}Retrieve asset security profile by IP or hostname including vulnerability scan results, network activity, and risk score
{
"type": "object",
"required": [
"asset_identifier"
],
"properties": {
"time_range": {
"enum": [
"24h",
"7d",
"30d"
],
"type": "string",
"default": "7d"
},
"asset_identifier": {
"type": "string",
"description": "IP address or hostname"
},
"include_vulnerabilities": {
"type": "boolean",
"default": true
},
"include_network_activity": {
"type": "boolean",
"default": false
}
}
}Retrieve detection rule details by detection ID including rule logic, metadata, and recent trigger history
{
"type": "object",
"required": [
"detection_id"
],
"properties": {
"detection_id": {
"type": "string"
},
"include_history": {
"type": "boolean",
"default": false
}
}
}Execute threat hunting query across network logs and endpoints using KQL, returns potential threats and hunt results
{
"type": "object",
"required": [
"kql"
],
"properties": {
"kql": {
"type": "string",
"description": "Kusto Query Language hunting query"
},
"timespan": {
"enum": [
"1h",
"4h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"hunt_name": {
"type": "string"
},
"save_hunt": {
"type": "boolean",
"default": false
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"network_logs",
"endpoint_logs",
"dns_logs",
"proxy_logs",
"firewall_logs"
],
"type": "string"
}
}
}
}List threat indicators with filtering by type, confidence, and source feeds, returns IOC details and metadata
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50
},
"status": {
"enum": [
"active",
"expired",
"whitelisted"
],
"type": "string"
},
"confidence": {
"enum": [
"high",
"medium",
"low"
],
"type": "string"
},
"feed_source": {
"type": "array",
"items": {
"type": "string"
}
},
"indicator_type": {
"type": "array",
"items": {
"enum": [
"ip",
"domain",
"url",
"hash",
"email",
"file"
],
"type": "string"
}
}
}
}Search security events using SPL query with time range and severity filters, returns matching events with metadata
{
"type": "object",
"required": [
"spl"
],
"properties": {
"spl": {
"type": "string",
"description": "Splunk Processing Language query"
},
"limit": {
"type": "integer",
"default": 100,
"maximum": 10000
},
"latest": {
"type": "string",
"description": "End time in ISO format or relative time"
},
"earliest": {
"type": "string",
"description": "Start time in ISO format or relative time"
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
}
}
}
}Update incident case status and add resolution notes, automatically timestamps status changes
{
"type": "object",
"required": [
"case_id",
"status"
],
"properties": {
"status": {
"enum": [
"new",
"assigned",
"investigating",
"resolved",
"closed",
"false_positive"
],
"type": "string"
},
"case_id": {
"type": "string"
},
"escalate": {
"type": "boolean",
"default": false
},
"resolution_notes": {
"type": "string"
}
}
}