loading…
Investigate and Contain a Security Incident
/api/mcp/srv-incident-responseMCP enable + token are only for calling from an external client — the playground below needs neither.
Add evidence artifact to incident case including files, network captures, memory dumps, or forensic images
{
"type": "object",
"required": [
"case_id",
"artifact_type",
"description"
],
"properties": {
"hash": {
"type": "string"
},
"case_id": {
"type": "string"
},
"file_path": {
"type": "string"
},
"description": {
"type": "string"
},
"artifact_type": {
"enum": [
"file",
"pcap",
"memory_dump",
"disk_image",
"log_file",
"screenshot"
],
"type": "string"
},
"chain_of_custody": {
"type": "string"
}
}
}Create new incident case from security events, alerts, or manual reporting with initial triage classification
{
"type": "object",
"required": [
"title",
"severity"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"title": {
"type": "string"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"assigned_to": {
"type": "string"
},
"description": {
"type": "string"
},
"source_events": {
"type": "array",
"items": {
"type": "string"
}
},
"initial_classification": {
"enum": [
"malware",
"phishing",
"data_breach",
"unauthorized_access",
"dos",
"other"
],
"type": "string"
}
}
}Escalate incident case to higher tier analyst or external teams with escalation reason and urgency level
{
"type": "object",
"required": [
"case_id",
"escalate_to",
"reason"
],
"properties": {
"reason": {
"type": "string"
},
"case_id": {
"type": "string"
},
"urgency": {
"enum": [
"low",
"medium",
"high",
"emergency"
],
"type": "string"
},
"escalate_to": {
"enum": [
"tier2",
"tier3",
"management",
"external_team"
],
"type": "string"
},
"additional_context": {
"type": "string"
}
}
}Retrieve detailed incident case information including timeline, artifacts, notes, and related events by case ID
{
"type": "object",
"required": [
"case_id"
],
"properties": {
"case_id": {
"type": "string"
},
"include_timeline": {
"type": "boolean",
"default": true
},
"include_artifacts": {
"type": "boolean",
"default": true
}
}
}Execute threat hunting query across endpoints and network data using YARA rules, Sigma rules, or custom hunt logic
{
"type": "object",
"required": [
"hunt_name",
"hunt_type",
"rule_content"
],
"properties": {
"hunt_name": {
"type": "string"
},
"hunt_type": {
"enum": [
"yara",
"sigma",
"custom",
"behavioral"
],
"type": "string"
},
"time_range": {
"enum": [
"last_1h",
"last_4h",
"last_24h",
"last_7d",
"last_30d"
],
"type": "string"
},
"rule_content": {
"type": "string"
},
"save_results": {
"type": "boolean",
"default": true
},
"target_systems": {
"type": "array",
"items": {
"type": "string"
}
}
}
}List incident cases with filtering by status, severity, assigned analyst, and creation date range
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50
},
"offset": {
"type": "integer",
"default": 0
},
"status": {
"enum": [
"new",
"in_progress",
"pending",
"resolved",
"closed"
],
"type": "string"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"assigned_to": {
"type": "string"
},
"created_after": {
"type": "string",
"format": "date-time"
},
"created_before": {
"type": "string",
"format": "date-time"
}
}
}Search security events across data sources using SPL, KQL, or natural language queries with time range and source filters
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"query": {
"type": "string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"query_type": {
"enum": [
"spl",
"kql",
"natural"
],
"type": "string"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"last_15m",
"last_1h",
"last_4h",
"last_24h",
"last_7d",
"custom"
],
"type": "string"
},
"data_sources": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Search threat indicators (IOCs) including IPs, domains, hashes, and URLs with reputation scoring and threat intelligence context
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"source": {
"type": "string"
},
"indicator": {
"type": "string"
},
"threat_level": {
"enum": [
"unknown",
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"indicator_type": {
"enum": [
"ip",
"domain",
"hash",
"url",
"email"
],
"type": "string"
},
"first_seen_after": {
"type": "string",
"format": "date-time"
}
}
}Update incident case status and add status change notes for case progression tracking
{
"type": "object",
"required": [
"case_id",
"status"
],
"properties": {
"notes": {
"type": "string"
},
"status": {
"enum": [
"new",
"in_progress",
"pending",
"resolved",
"closed"
],
"type": "string"
},
"case_id": {
"type": "string"
},
"assigned_to": {
"type": "string"
}
}
}