loading…
Hunt for signs of credential dumping without starting from an alert
/api/mcp/srv-threat-huntingMCP enable + token are only for calling from an external client — the playground below needs neither.
Analyze tactics, techniques, and procedures (TTPs) from MITRE ATT&CK framework against organizational telemetry and detection coverage
{
"type": "object",
"required": [
"technique_id"
],
"properties": {
"tactic": {
"enum": [
"initial-access",
"execution",
"persistence",
"privilege-escalation",
"defense-evasion",
"credential-access",
"discovery",
"lateral-movement",
"collection",
"command-and-control",
"exfiltration",
"impact"
],
"type": "string"
},
"time_range": {
"enum": [
"7d",
"30d",
"90d",
"1y"
],
"type": "string"
},
"technique_id": {
"type": "string",
"pattern": "^T[0-9]{4}(\\.[0-9]{3})?$"
},
"include_subtechniques": {
"type": "boolean",
"default": false
}
}
}Create a new detection rule from threat hunting findings with MITRE ATT&CK mapping and alert configuration
{
"type": "object",
"required": [
"rule_name",
"query",
"query_language",
"severity"
],
"properties": {
"query": {
"type": "string"
},
"enabled": {
"type": "boolean",
"default": false
},
"hunt_id": {
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
},
"rule_name": {
"type": "string"
},
"description": {
"type": "string"
},
"data_sources": {
"type": "array",
"items": {
"type": "string"
}
},
"query_language": {
"enum": [
"kql",
"spl",
"sql",
"sigma"
],
"type": "string"
},
"mitre_techniques": {
"type": "array",
"items": {
"type": "string"
}
},
"false_positive_rate": {
"enum": [
"low",
"medium",
"high"
],
"type": "string"
}
}
}Initialize new threat hunt campaign with hypothesis, tactics, techniques, and data sources to investigate
{
"type": "object",
"required": [
"name",
"hypothesis"
],
"properties": {
"name": {
"type": "string"
},
"priority": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"hypothesis": {
"type": "string"
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"endpoint",
"network",
"dns",
"proxy",
"email",
"cloud",
"threat_intel"
],
"type": "string"
}
},
"mitre_tactics": {
"type": "array",
"items": {
"type": "string"
}
},
"assigned_analyst": {
"type": "string"
},
"mitre_techniques": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Enrich indicators with threat intelligence context, reputation scores, attribution, and related campaigns from multiple feeds
{
"type": "object",
"required": [
"indicators"
],
"properties": {
"indicators": {
"type": "array",
"items": {
"type": "string"
},
"maxItems": 100
},
"intel_sources": {
"type": "array",
"items": {
"enum": [
"commercial",
"government",
"open_source",
"internal",
"all"
],
"type": "string"
}
},
"include_campaigns": {
"type": "boolean",
"default": true
},
"include_attribution": {
"type": "boolean",
"default": true
},
"confidence_threshold": {
"type": "integer",
"default": 50,
"maximum": 100,
"minimum": 0
}
}
}Enrich indicators and entities with open source threat intelligence from multiple feeds including reputation scores and attribution data
{
"type": "object",
"required": [
"indicators"
],
"properties": {
"indicators": {
"type": "array",
"items": {
"type": "object",
"required": [
"type",
"value"
],
"properties": {
"type": {
"enum": [
"ip",
"domain",
"hash",
"url",
"email"
],
"type": "string"
},
"value": {
"type": "string"
}
}
}
},
"osint_sources": {
"type": "array",
"items": {
"enum": [
"virustotal",
"urlvoid",
"abuseipdb",
"shodan",
"passivetotal",
"hybrid_analysis"
],
"type": "string"
}
},
"include_historical": {
"type": "boolean",
"default": false
},
"confidence_threshold": {
"type": "integer",
"default": 50,
"maximum": 100,
"minimum": 0
}
}
}Execute a threat hunting query using KQL, SPL, or SQL against security data lakes including SIEM logs, EDR telemetry, and network flows
{
"type": "object",
"required": [
"query",
"query_language",
"data_sources"
],
"properties": {
"query": {
"type": "string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d",
"custom"
],
"type": "string"
},
"max_results": {
"type": "integer",
"default": 1000,
"maximum": 10000,
"minimum": 1
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"siem",
"edr",
"network",
"dns",
"proxy",
"email"
],
"type": "string"
}
},
"query_language": {
"enum": [
"kql",
"spl",
"sql"
],
"type": "string"
}
}
}Generate and export comprehensive threat hunting reports in multiple formats including IOCs, MITRE mappings, and executive summaries
{
"type": "object",
"required": [
"hunt_id",
"report_format"
],
"properties": {
"hunt_id": {
"type": "string"
},
"report_format": {
"enum": [
"pdf",
"docx",
"json",
"stix",
"misp"
],
"type": "string"
},
"classification": {
"enum": [
"unclassified",
"internal",
"confidential"
],
"type": "string"
},
"include_sections": {
"type": "array",
"items": {
"enum": [
"executive_summary",
"methodology",
"findings",
"iocs",
"mitre_mapping",
"recommendations",
"appendix"
],
"type": "string"
}
},
"recipient_emails": {
"type": "array",
"items": {
"type": "string",
"format": "email"
}
}
}
}Fetch detailed information for a specific detection including timeline, artifacts, and investigation notes
{
"type": "object",
"required": [
"detection_id"
],
"properties": {
"detection_id": {
"type": "string"
},
"include_timeline": {
"type": "boolean",
"default": true
},
"include_artifacts": {
"type": "boolean",
"default": true
}
}
}Retrieve detailed information about a specific threat hunting campaign including hypotheses, queries, findings, and analyst notes
{
"type": "object",
"required": [
"hunt_id"
],
"properties": {
"hunt_id": {
"type": "string"
},
"include_notes": {
"type": "boolean",
"default": false
},
"include_queries": {
"type": "boolean",
"default": true
},
"include_findings": {
"type": "boolean",
"default": true
}
}
}Search for indicators of compromise (IOCs) across threat intelligence feeds and internal telemetry using queries, hash values, IP addresses, or domains
{
"type": "object",
"required": [
"query"
],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 10000,
"minimum": 1
},
"query": {
"type": "string",
"description": "KQL or SPL query string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"ioc_type": {
"enum": [
"hash",
"ip",
"domain",
"url",
"email",
"file_path",
"registry_key"
],
"type": "string"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"90d",
"custom"
],
"type": "string"
},
"threat_level": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
}
}
}List all active threat hunting campaigns with their status, assigned analysts, and key findings
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50,
"maximum": 100,
"minimum": 1
},
"status": {
"enum": [
"active",
"paused",
"completed",
"archived"
],
"type": "string"
},
"priority": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"threat_actor": {
"type": "string"
},
"created_after": {
"type": "string",
"format": "date-time"
},
"mitre_technique": {
"type": "string"
},
"assigned_analyst": {
"type": "string"
}
}
}Retrieve security detections and alerts with filtering by severity, status, detection rule, and time period
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50,
"maximum": 1000,
"minimum": 1
},
"offset": {
"type": "integer",
"default": 0,
"minimum": 0
},
"status": {
"type": "array",
"items": {
"enum": [
"new",
"assigned",
"investigating",
"resolved",
"false_positive"
],
"type": "string"
}
},
"rule_id": {
"type": "string"
},
"assignee": {
"type": "string"
},
"severity": {
"type": "array",
"items": {
"enum": [
"informational",
"low",
"medium",
"high",
"critical"
],
"type": "string"
}
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string"
}
}
}Retrieve active and completed threat hunting campaigns with status, findings count, and analyst assignments
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 25,
"maximum": 500,
"minimum": 1
},
"status": {
"type": "array",
"items": {
"enum": [
"active",
"completed",
"paused",
"cancelled"
],
"type": "string"
}
},
"analyst": {
"type": "string"
},
"priority": {
"type": "array",
"items": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
}
},
"created_after": {
"type": "string",
"format": "date-time"
}
}
}Perform threat hunting pivots on entities like users, hosts, processes, or network connections to discover related suspicious activity
{
"type": "object",
"required": [
"entity_type",
"entity_value"
],
"properties": {
"pivot_type": {
"enum": [
"lateral_movement",
"persistence",
"data_exfiltration",
"command_control",
"all"
],
"type": "string"
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"entity_type": {
"enum": [
"user",
"host",
"process",
"ip",
"domain",
"hash"
],
"type": "string"
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"endpoint",
"network",
"dns",
"proxy",
"email",
"cloud"
],
"type": "string"
}
},
"entity_value": {
"type": "string"
}
}
}Perform automated pivoting analysis on entities like IP addresses, domains, users, or hosts to discover related threats and suspicious activities
{
"type": "object",
"required": [
"entity_type",
"entity_value"
],
"properties": {
"entity_type": {
"enum": [
"ip",
"domain",
"user",
"host",
"process",
"file_hash"
],
"type": "string"
},
"pivot_depth": {
"type": "integer",
"default": 2,
"maximum": 3,
"minimum": 1
},
"data_sources": {
"type": "array",
"items": {
"enum": [
"siem",
"edr",
"network",
"dns",
"threat_intel"
],
"type": "string"
}
},
"entity_value": {
"type": "string"
},
"time_window_hours": {
"type": "integer",
"default": 24,
"maximum": 168,
"minimum": 1
},
"include_external_intel": {
"type": "boolean",
"default": true
}
}
}Update the triage status and analyst assignment for security alerts generated from detections or threat hunting activities
{
"type": "object",
"required": [
"alert_id",
"status"
],
"properties": {
"status": {
"enum": [
"new",
"investigating",
"true_positive",
"false_positive",
"closed"
],
"type": "string"
},
"alert_id": {
"type": "string"
},
"priority": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"triage_notes": {
"type": "string"
},
"assigned_analyst": {
"type": "string"
},
"escalate_to_incident": {
"type": "boolean",
"default": false
}
}
}Update detection status, assign analyst, add investigation notes, and set severity level
{
"type": "object",
"required": [
"detection_id"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
}
},
"notes": {
"type": "string"
},
"status": {
"enum": [
"new",
"assigned",
"investigating",
"resolved",
"false_positive"
],
"type": "string"
},
"assignee": {
"type": "string"
},
"severity": {
"enum": [
"informational",
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"detection_id": {
"type": "string"
}
}
}