loading…
Investigate a suspicious account takeover
/api/mcp/srv-identity-threat-detectionMCP enable + token are only for calling from an external client — the playground below needs neither.
Generate threat intelligence metrics and trends for identity-based attacks across specified time periods and organizational units
{
"type": "object",
"required": [
"metric_types"
],
"properties": {
"end_time": {
"type": "string",
"format": "date-time"
},
"group_by": {
"type": "array",
"items": {
"enum": [
"department",
"location",
"user_type",
"attack_vector"
],
"type": "string"
}
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"last_24h",
"last_7d",
"last_30d",
"last_90d",
"custom"
],
"type": "string"
},
"metric_types": {
"type": "array",
"items": {
"enum": [
"attack_volume",
"risk_distribution",
"detection_accuracy",
"mean_time_to_detect",
"compromised_accounts"
],
"type": "string"
}
},
"organizational_unit": {
"type": "string"
}
}
}Create new identity threat investigation case with assigned analyst, priority level, and initial evidence collection
{
"type": "object",
"required": [
"title",
"priority",
"assigned_analyst"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"title": {
"type": "string"
},
"priority": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"description": {
"type": "string"
},
"affected_users": {
"type": "array",
"items": {
"type": "string"
}
},
"related_events": {
"type": "array",
"items": {
"type": "string"
}
},
"assigned_analyst": {
"type": "string"
}
}
}Add user, group, or service account to identity monitoring watchlist with specific monitoring rules and alert thresholds
{
"type": "object",
"required": [
"entity_type",
"entity_id",
"watchlist_type",
"monitoring_rules"
],
"properties": {
"reason": {
"type": "string"
},
"entity_id": {
"type": "string"
},
"entity_type": {
"enum": [
"user",
"group",
"service_account"
],
"type": "string"
},
"expiry_date": {
"type": "string",
"format": "date-time"
},
"watchlist_type": {
"enum": [
"high_risk",
"privileged",
"terminated",
"suspicious",
"vip"
],
"type": "string"
},
"alert_threshold": {
"enum": [
"low",
"medium",
"high"
],
"type": "string"
},
"monitoring_rules": {
"type": "array",
"items": {
"enum": [
"login_anomalies",
"privilege_changes",
"data_access",
"after_hours",
"geo_anomalies"
],
"type": "string"
}
}
}
}Disable user account immediately for security containment with reason code and analyst authorization
{
"type": "object",
"required": [
"user_id",
"reason",
"analyst_id"
],
"properties": {
"notes": {
"type": "string"
},
"reason": {
"enum": [
"compromised",
"policy_violation",
"terminated",
"suspicious_activity"
],
"type": "string"
},
"user_id": {
"type": "string"
},
"analyst_id": {
"type": "string"
},
"notify_user": {
"type": "boolean",
"default": false
},
"disable_all_sessions": {
"type": "boolean",
"default": true
}
}
}Fetch detailed information for a specific identity threat detection including timeline, affected entities, and investigation notes
{
"type": "object",
"required": [
"detection_id"
],
"properties": {
"detection_id": {
"type": "string"
}
}
}Get chronological timeline of identity events for specific user showing authentication, authorization, and risk events
{
"type": "object",
"required": [
"user_id",
"start_time",
"end_time"
],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 1000,
"minimum": 1
},
"user_id": {
"type": "string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"event_types": {
"type": "array",
"items": {
"enum": [
"login",
"logout",
"password_change",
"mfa_enrollment",
"privilege_change",
"risk_event",
"policy_violation"
],
"type": "string"
}
},
"include_context": {
"type": "boolean",
"default": true
}
}
}Get comprehensive user identity profile including risk score, recent activities, group memberships, and behavioral baselines
{
"type": "object",
"required": [
"user_id"
],
"properties": {
"user_id": {
"type": "string"
},
"activity_days": {
"type": "integer",
"default": 30,
"maximum": 90,
"minimum": 1
},
"include_groups": {
"type": "boolean",
"default": true
},
"include_devices": {
"type": "boolean",
"default": true
},
"include_activities": {
"type": "boolean",
"default": true
}
}
}Retrieve comprehensive risk assessment for a specific user including behavior baselines, recent activities, and current risk score
{
"type": "object",
"required": [
"user_id"
],
"properties": {
"user_id": {
"type": "string"
},
"timeline_days": {
"type": "integer",
"default": 30,
"maximum": 90
},
"include_timeline": {
"type": "boolean",
"default": true
}
}
}Search for identity-based anomalies and suspicious behaviors using query filters across user activities, authentication events, and privilege changes
{
"type": "object",
"required": [
"query"
],
"properties": {
"query": {
"type": "string",
"description": "KQL or custom query syntax"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"user_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"last_1h",
"last_24h",
"last_7d",
"last_30d",
"custom"
],
"type": "string"
},
"threat_types": {
"type": "array",
"items": {
"enum": [
"credential_stuffing",
"privilege_escalation",
"lateral_movement",
"account_takeover",
"insider_threat"
],
"type": "string"
}
},
"risk_score_min": {
"type": "integer",
"maximum": 100,
"minimum": 0
}
}
}Execute threat hunt using IOCs, TTPs, and behavioral patterns across identity data sources and authentication logs
{
"type": "object",
"required": [
"hunt_name",
"indicators"
],
"properties": {
"end_time": {
"type": "string",
"format": "date-time"
},
"hunt_name": {
"type": "string"
},
"indicators": {
"type": "array",
"items": {
"type": "object",
"properties": {
"type": {
"enum": [
"ip",
"user_agent",
"geolocation",
"device_id",
"application"
],
"type": "string"
},
"value": {
"type": "string"
},
"operator": {
"enum": [
"equals",
"contains",
"regex",
"not_equals"
],
"type": "string"
}
}
}
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"custom"
],
"type": "string"
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"azure_ad",
"okta",
"active_directory",
"aws_iam",
"google_workspace"
],
"type": "string"
}
}
}
}Analyze potential lateral movement patterns for a specific user or compromised account across network resources and privilege escalations
{
"type": "object",
"required": [
"user_id"
],
"properties": {
"user_id": {
"type": "string"
},
"resource_types": {
"type": "array",
"items": {
"enum": [
"file_shares",
"databases",
"applications",
"admin_systems",
"cloud_resources"
],
"type": "string"
}
},
"time_window_hours": {
"type": "integer",
"default": 24,
"maximum": 168
},
"investigation_scope": {
"enum": [
"user_only",
"user_and_peers",
"full_network"
],
"type": "string"
},
"include_related_accounts": {
"type": "boolean",
"default": true
}
}
}Get accounts flagged as compromised or at high risk with filtering by compromise type, detection time, and remediation status
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 1000
},
"detected_since": {
"type": "string",
"format": "date-time"
},
"risk_score_min": {
"type": "integer",
"maximum": 100,
"minimum": 0
},
"compromise_type": {
"type": "array",
"items": {
"enum": [
"credential_theft",
"session_hijacking",
"privilege_abuse",
"brute_force",
"impossible_travel"
],
"type": "string"
}
},
"remediation_status": {
"type": "array",
"items": {
"enum": [
"none",
"password_reset",
"account_disabled",
"mfa_enforced",
"monitored"
],
"type": "string"
}
}
}
}Retrieve identity threat detections with filtering by severity, status, assigned analyst, and detection rule
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50,
"maximum": 1000
},
"offset": {
"type": "integer",
"default": 0
},
"status": {
"type": "array",
"items": {
"enum": [
"new",
"in_progress",
"resolved",
"false_positive",
"suppressed"
],
"type": "string"
}
},
"sort_by": {
"enum": [
"created_time",
"risk_score",
"severity"
],
"type": "string",
"default": "created_time"
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
}
},
"sort_order": {
"enum": [
"asc",
"desc"
],
"type": "string",
"default": "desc"
},
"assigned_to": {
"type": "string"
},
"detection_rule_id": {
"type": "string"
}
}
}List identity risk events with aggregation by user, risk score, and detection rule to prioritize investigation
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50,
"maximum": 500,
"minimum": 1
},
"status": {
"enum": [
"new",
"investigating",
"resolved",
"false_positive"
],
"type": "string"
},
"sort_by": {
"enum": [
"timestamp",
"risk_score",
"user_id"
],
"type": "string",
"default": "timestamp"
},
"user_id": {
"type": "string"
},
"event_type": {
"enum": [
"impossible_travel",
"credential_stuffing",
"privilege_escalation",
"suspicious_login",
"account_takeover"
],
"type": "string"
},
"risk_level": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d"
],
"type": "string"
}
}
}Search identity anomalies using query filters to find suspicious authentication patterns, privilege escalations, and behavioral deviations
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 1000,
"minimum": 1
},
"query": {
"type": "string",
"description": "KQL query for anomaly search"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"custom"
],
"type": "string"
},
"entity_type": {
"enum": [
"user",
"device",
"application",
"service_account"
],
"type": "string"
}
}
}Update detection status, assign analyst, add investigation notes, and set disposition for identity threat cases
{
"type": "object",
"required": [
"detection_id"
],
"properties": {
"notes": {
"type": "string"
},
"status": {
"enum": [
"new",
"in_progress",
"resolved",
"false_positive",
"suppressed"
],
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"assigned_to": {
"type": "string"
},
"disposition": {
"enum": [
"true_positive",
"false_positive",
"benign_positive"
],
"type": "string"
},
"detection_id": {
"type": "string"
}
}
}Update user or entity risk score based on new evidence, analyst assessment, or automated risk calculation
{
"type": "object",
"required": [
"entity_id",
"entity_type",
"risk_score",
"reason"
],
"properties": {
"reason": {
"type": "string"
},
"entity_id": {
"type": "string"
},
"analyst_id": {
"type": "string"
},
"risk_score": {
"type": "integer",
"maximum": 100,
"minimum": 0
},
"entity_type": {
"enum": [
"user",
"device",
"application"
],
"type": "string"
},
"expiration_date": {
"type": "string",
"format": "date-time"
}
}
}