loading…
No description
/api/mcp/srv-soc-operationsMCP enable + token are only for calling from an external client — the playground below needs neither.
Create investigation case from one or more alerts with initial classification
{
"type": "object",
"required": [
"title",
"alert_ids",
"severity"
],
"properties": {
"title": {
"type": "string"
},
"assignee": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"alert_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "Alert IDs to include in case"
},
"description": {
"type": "string"
},
"classification": {
"enum": [
"malware",
"phishing",
"data_exfiltration",
"insider_threat",
"reconnaissance",
"denial_of_service",
"other"
],
"type": "string"
}
}
}Enrich security artifact with threat intelligence, reputation scores, and contextual information
{
"type": "object",
"required": [
"artifact_value",
"artifact_type"
],
"properties": {
"artifact_type": {
"enum": [
"ip",
"domain",
"url",
"hash",
"email"
],
"type": "string"
},
"artifact_value": {
"type": "string",
"description": "Artifact to enrich like IP, domain, hash"
},
"enrichment_sources": {
"type": "array",
"items": {
"enum": [
"virustotal",
"passivetotal",
"shodan",
"threatcrowd",
"internal_intel"
],
"type": "string"
},
"default": [
"virustotal",
"internal_intel"
]
}
}
}Enrich IOCs with threat intelligence from configured feeds and reputation sources
{
"type": "object",
"required": [
"indicators"
],
"properties": {
"indicators": {
"type": "array",
"items": {
"type": "string"
},
"description": "IP addresses, domains, file hashes, or URLs"
},
"intel_sources": {
"type": "array",
"items": {
"enum": [
"virustotal",
"threatconnect",
"misp",
"internal_feeds",
"all"
],
"type": "string"
},
"default": [
"all"
]
}
}
}Execute SOAR playbook against specified alert or case with optional parameter overrides
{
"type": "object",
"required": [
"playbook_id",
"target_id",
"target_type"
],
"properties": {
"target_id": {
"type": "string",
"description": "Alert ID or Case ID"
},
"parameters": {
"type": "object",
"description": "Playbook-specific parameters"
},
"playbook_id": {
"type": "string"
},
"target_type": {
"enum": [
"alert",
"case"
],
"type": "string"
},
"auto_approve": {
"type": "boolean",
"default": false,
"description": "Skip manual approval steps"
}
}
}Retrieve detailed alert information including events, artifacts, and investigation timeline
{
"type": "object",
"required": [
"alert_id"
],
"properties": {
"alert_id": {
"type": "string",
"description": "Unique alert identifier"
}
}
}Retrieve SOC operational metrics including MTTD, MTTR, alert volume, and analyst workload
{
"type": "object",
"required": [],
"properties": {
"metrics": {
"type": "array",
"items": {
"enum": [
"alert_volume",
"mttd",
"mttr",
"case_backlog",
"analyst_workload",
"sla_compliance"
],
"type": "string"
},
"default": [
"alert_volume",
"mttd",
"mttr"
]
},
"group_by": {
"enum": [
"hour",
"day",
"week",
"analyst",
"severity"
],
"type": "string"
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string",
"default": "24h"
}
}
}Retrieve a specific notable event by ID with full context including artifacts, timeline, and assigned analyst
{
"type": "object",
"required": [
"notable_id"
],
"properties": {
"notable_id": {
"type": "string",
"description": "Unique notable event identifier"
},
"include_timeline": {
"type": "boolean",
"default": true
},
"include_artifacts": {
"type": "boolean",
"default": true
}
}
}Search for indicators of compromise across endpoints, network logs, and threat intelligence feeds
{
"type": "object",
"required": [
"ioc_value",
"ioc_type"
],
"properties": {
"ioc_type": {
"enum": [
"ip",
"domain",
"url",
"hash_md5",
"hash_sha1",
"hash_sha256",
"email"
],
"type": "string"
},
"ioc_value": {
"type": "string",
"description": "IOC value like IP, domain, hash"
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"endpoints",
"network",
"email",
"web_proxy",
"dns"
],
"type": "string"
}
},
"lookback_hours": {
"type": "integer",
"default": 24,
"description": "Hours to search backwards"
}
}
}Execute threat hunting query across endpoints and network data with IOC matching
{
"type": "object",
"required": [
"hunt_name",
"query"
],
"properties": {
"iocs": {
"type": "array",
"items": {
"type": "string"
},
"description": "Indicators of Compromise to search for"
},
"query": {
"type": "string",
"description": "KQL or hunting query"
},
"hunt_name": {
"type": "string"
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string",
"default": "24h"
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"endpoints",
"network",
"email",
"cloud_logs"
],
"type": "string"
},
"default": [
"endpoints"
]
}
}
}List security alerts with filtering by severity, status, assignee, and time range
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50,
"maximum": 1000
},
"offset": {
"type": "integer",
"default": 0
},
"status": {
"enum": [
"new",
"assigned",
"in_progress",
"resolved",
"closed",
"false_positive"
],
"type": "string"
},
"assignee": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"created_after": {
"type": "string",
"format": "date-time"
},
"created_before": {
"type": "string",
"format": "date-time"
}
}
}List active detection rules with filtering by severity, data source, and MITRE ATT&CK technique coverage
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"status": {
"enum": [
"enabled",
"disabled",
"testing"
],
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"data_source": {
"type": "string",
"description": "Filter by data source like Windows, Linux, Network"
},
"mitre_technique": {
"type": "string",
"description": "MITRE ATT&CK technique ID like T1055"
}
}
}List available SOAR playbooks filtered by trigger type and automation level
{
"type": "object",
"required": [],
"properties": {
"category": {
"enum": [
"containment",
"investigation",
"notification",
"remediation"
],
"type": "string"
},
"trigger_type": {
"enum": [
"alert",
"case",
"manual",
"scheduled"
],
"type": "string"
},
"automation_level": {
"enum": [
"fully_automated",
"semi_automated",
"manual"
],
"type": "string"
}
}
}Query threat intelligence feeds for IOCs, TTPs, and campaign information with confidence scoring
{
"type": "object",
"required": [],
"properties": {
"query": {
"type": "string",
"description": "Search term for IOCs or threat actor names"
},
"source": {
"type": "string",
"description": "Specific threat intel feed name"
},
"days_back": {
"type": "integer",
"default": 30
},
"intel_type": {
"enum": [
"ioc",
"ttp",
"campaign",
"actor",
"malware"
],
"type": "string"
},
"confidence_min": {
"type": "integer",
"maximum": 100,
"minimum": 0,
"description": "Minimum confidence score"
}
}
}Search security events across data sources using SPL query with time range and source filters
{
"type": "object",
"required": [
"spl"
],
"properties": {
"spl": {
"type": "string",
"description": "Splunk Processing Language query"
},
"index": {
"type": "string",
"description": "Splunk index to search"
},
"limit": {
"type": "integer",
"default": 100,
"maximum": 10000
},
"latest": {
"type": "string",
"description": "End time (ISO 8601 or relative like now)"
},
"earliest": {
"type": "string",
"description": "Start time (ISO 8601 or relative like -24h)"
}
}
}Update notable event status, priority, and assignment during analyst triage workflow
{
"type": "object",
"required": [
"notable_id",
"status"
],
"properties": {
"status": {
"enum": [
"new",
"in_progress",
"resolved",
"closed",
"false_positive"
],
"type": "string"
},
"comments": {
"type": "string",
"description": "Triage notes and findings"
},
"priority": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"notable_id": {
"type": "string",
"description": "Notable event ID to update"
},
"assigned_to": {
"type": "string",
"description": "Analyst username or team"
}
}
}Change alert status and assign to analyst with optional notes
{
"type": "object",
"required": [
"alert_id",
"status"
],
"properties": {
"notes": {
"type": "string",
"description": "Investigation notes or status change reason"
},
"status": {
"enum": [
"new",
"assigned",
"in_progress",
"resolved",
"closed",
"false_positive"
],
"type": "string"
},
"alert_id": {
"type": "string"
},
"assignee": {
"type": "string",
"description": "Username of assigned analyst"
}
}
}Execute or update incident response playbook steps with completion status and analyst notes
{
"type": "object",
"required": [
"case_id",
"step_id",
"status"
],
"properties": {
"status": {
"enum": [
"pending",
"in_progress",
"completed",
"skipped",
"blocked"
],
"type": "string"
},
"case_id": {
"type": "string",
"description": "Case ID for playbook execution"
},
"step_id": {
"type": "string",
"description": "Specific playbook step"
},
"next_action": {
"type": "string",
"description": "Recommended next step"
},
"playbook_id": {
"type": "string",
"description": "Playbook template identifier"
},
"completion_notes": {
"type": "string",
"description": "Step execution details and findings"
}
}
}