loading…
Check whether a departing employee is taking company data
/api/mcp/srv-insider-risk-investigationMCP enable + token are only for calling from an external client — the playground below needs neither.
Add digital evidence artifact to investigation case with chain of custody metadata and evidence classification
{
"type": "object",
"required": [
"case_id",
"evidence_type",
"description",
"collected_by"
],
"properties": {
"case_id": {
"type": "string"
},
"hash_md5": {
"type": "string"
},
"file_path": {
"type": "string"
},
"description": {
"type": "string"
},
"hash_sha256": {
"type": "string"
},
"collected_by": {
"type": "string"
},
"evidence_type": {
"enum": [
"email",
"file",
"log_entry",
"screenshot",
"network_capture",
"usb_activity"
],
"type": "string"
},
"source_system": {
"type": "string"
}
}
}Create new insider risk investigation case from alerts or manual initiation with employee subject and initial classification
{
"type": "object",
"required": [
"employee_id",
"title",
"priority"
],
"properties": {
"title": {
"type": "string"
},
"priority": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"alert_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"assignee_id": {
"type": "string"
},
"description": {
"type": "string"
},
"employee_id": {
"type": "string"
},
"risk_category": {
"enum": [
"data_theft",
"sabotage",
"fraud",
"policy_violation",
"workplace_violence"
],
"type": "string"
}
}
}Add user to insider risk watchlist with monitoring parameters and justification
{
"type": "object",
"required": [
"user_id",
"risk_level",
"justification"
],
"properties": {
"user_id": {
"type": "string",
"description": "User to add to watchlist"
},
"reviewer": {
"type": "string",
"description": "Supervising analyst username"
},
"risk_level": {
"enum": [
"elevated",
"high",
"critical"
],
"type": "string"
},
"justification": {
"type": "string",
"description": "Reason for watchlist placement"
},
"alert_threshold": {
"enum": [
"low",
"medium",
"high"
],
"type": "string"
},
"monitoring_scope": {
"type": "array",
"items": {
"enum": [
"file_access",
"email_activity",
"network_activity",
"application_usage",
"authentication_events",
"all"
],
"type": "string"
}
},
"monitoring_duration_days": {
"type": "integer",
"default": 30,
"maximum": 365,
"minimum": 1
}
}
}Escalate an insider risk case to higher priority level or different team with justification
{
"type": "object",
"required": [
"case_id",
"escalation_level",
"justification"
],
"properties": {
"case_id": {
"type": "string",
"description": "Case identifier to escalate"
},
"priority": {
"enum": [
"medium",
"high",
"urgent"
],
"type": "string"
},
"assign_to": {
"type": "string",
"description": "Username to assign escalated case"
},
"justification": {
"type": "string",
"description": "Reason for escalation"
},
"escalation_level": {
"enum": [
"tier2",
"tier3",
"legal",
"hr",
"management"
],
"type": "string"
}
}
}Generate comprehensive insider risk assessment report for user, department, or organization
{
"type": "object",
"required": [
"report_type",
"report_period"
],
"properties": {
"format": {
"enum": [
"pdf",
"json",
"csv"
],
"type": "string"
},
"user_id": {
"type": "string",
"description": "For user-specific reports"
},
"end_date": {
"type": "string",
"format": "date"
},
"department": {
"type": "string",
"description": "For department reports"
},
"start_date": {
"type": "string",
"format": "date"
},
"report_type": {
"enum": [
"user_assessment",
"department_summary",
"executive_summary",
"compliance_report"
],
"type": "string"
},
"report_period": {
"enum": [
"weekly",
"monthly",
"quarterly",
"custom"
],
"type": "string"
},
"include_trending": {
"type": "boolean",
"default": true
},
"include_recommendations": {
"type": "boolean",
"default": true
}
}
}Retrieve a specific insider risk case by case ID including timeline, evidence, and current status
{
"type": "object",
"required": [
"case_id"
],
"properties": {
"case_id": {
"type": "string",
"description": "Unique case identifier"
},
"include_evidence": {
"type": "boolean",
"default": true
},
"include_timeline": {
"type": "boolean",
"default": true
},
"include_related_users": {
"type": "boolean",
"default": false
}
}
}Retrieve comprehensive employee risk profile including current risk score, historical alerts, access patterns, and behavioral analytics
{
"type": "object",
"required": [
"employee_id"
],
"properties": {
"employee_id": {
"type": "string"
},
"lookback_days": {
"type": "integer",
"default": 90
},
"include_access_patterns": {
"type": "boolean",
"default": true
},
"include_historical_alerts": {
"type": "boolean",
"default": true
}
}
}Retrieve comprehensive user risk profile including risk score, recent activities, and behavioral baselines
{
"type": "object",
"required": [
"user_id"
],
"properties": {
"user_id": {
"type": "string",
"description": "Target user identifier"
},
"activity_days": {
"type": "integer",
"default": 30,
"maximum": 365,
"minimum": 1
},
"include_activities": {
"type": "boolean",
"default": true
},
"include_peer_analysis": {
"type": "boolean",
"default": false
}
}
}Execute threat hunting query across user activity data using custom search criteria and behavioral indicators
{
"type": "object",
"required": [
"query",
"time_range"
],
"properties": {
"query": {
"type": "string"
},
"time_range": {
"enum": [
"last_24h",
"last_7d",
"last_30d",
"last_90d"
],
"type": "string"
},
"employee_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"activity_types": {
"type": "array",
"items": {
"enum": [
"file_access",
"email_send",
"usb_insert",
"login",
"application_use",
"network_transfer"
],
"type": "string"
}
},
"include_baseline": {
"type": "boolean",
"default": false
}
}
}List insider risk investigation cases with filtering by assignee, priority, status, and creation date
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 25
},
"status": {
"enum": [
"new",
"assigned",
"investigating",
"pending_review",
"closed"
],
"type": "string"
},
"priority": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"assignee_id": {
"type": "string"
},
"created_after": {
"type": "string",
"format": "date"
},
"created_before": {
"type": "string",
"format": "date"
}
}
}List active and historical insider risk investigations with filtering by assignee, priority, and status
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50,
"maximum": 500
},
"offset": {
"type": "integer",
"default": 0
},
"status": {
"enum": [
"open",
"in_progress",
"pending_review",
"closed",
"archived"
],
"type": "string"
},
"assignee": {
"type": "string",
"description": "Assigned analyst username"
},
"priority": {
"enum": [
"low",
"medium",
"high",
"urgent"
],
"type": "string"
},
"created_after": {
"type": "string",
"format": "date-time"
},
"created_before": {
"type": "string",
"format": "date-time"
}
}
}Execute behavioral analytics hunt across user population using predefined or custom hunt queries
{
"type": "object",
"required": [
"hunt_type",
"time_window"
],
"properties": {
"hunt_type": {
"enum": [
"data_hoarding",
"off_hours_access",
"privilege_escalation",
"lateral_movement",
"exfiltration_patterns",
"custom"
],
"type": "string"
},
"user_list": {
"type": "array",
"items": {
"type": "string"
}
},
"department": {
"type": "string"
},
"hunt_query": {
"type": "string",
"description": "Custom behavioral analytics query"
},
"time_window": {
"enum": [
"1d",
"7d",
"30d",
"90d"
],
"type": "string"
},
"target_population": {
"enum": [
"all_users",
"high_risk_users",
"department",
"custom_list"
],
"type": "string"
},
"confidence_threshold": {
"type": "number",
"default": 0.7,
"maximum": 1,
"minimum": 0
}
}
}Search insider risk alerts using filters for risk score, user, behavior type, and time range
{
"type": "object",
"required": [
"time_range"
],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 1000
},
"query": {
"type": "string",
"description": "Free text search across alert metadata"
},
"status": {
"enum": [
"new",
"investigating",
"closed",
"false_positive"
],
"type": "string"
},
"user_id": {
"type": "string",
"description": "Target user identifier"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"90d",
"custom"
],
"type": "string"
},
"behavior_types": {
"type": "array",
"items": {
"enum": [
"data_exfiltration",
"policy_violation",
"anomalous_access",
"credential_abuse",
"unauthorized_download",
"suspicious_email",
"after_hours_activity"
],
"type": "string"
}
},
"risk_score_max": {
"type": "integer",
"maximum": 100,
"minimum": 0
},
"risk_score_min": {
"type": "integer",
"maximum": 100,
"minimum": 0
}
}
}Update the status of an insider risk case with analyst notes and disposition
{
"type": "object",
"required": [
"case_id",
"status"
],
"properties": {
"status": {
"enum": [
"open",
"in_progress",
"pending_review",
"closed",
"false_positive",
"archived"
],
"type": "string"
},
"case_id": {
"type": "string",
"description": "Case identifier"
},
"disposition": {
"enum": [
"confirmed_threat",
"policy_violation",
"benign_anomaly",
"insufficient_evidence",
"administrative_closure"
],
"type": "string"
},
"analyst_notes": {
"type": "string",
"description": "Investigation notes and findings"
},
"resolution_summary": {
"type": "string",
"description": "Summary of case resolution"
}
}
}