loading…
Investigate unexpected changes to privileged AD groups
/api/mcp/srv-active-directory-securityMCP enable + token are only for calling from an external client — the playground below needs neither.
Audit group membership hierarchy and effective permissions for security groups and distribution lists
{
"type": "object",
"required": [
"group_dn"
],
"properties": {
"group_dn": {
"type": "string"
},
"group_name": {
"type": "string"
},
"permission_scope": {
"enum": [
"domain",
"forest",
"local"
],
"type": "string",
"default": "domain"
},
"include_nested_groups": {
"type": "boolean",
"default": true
},
"show_effective_rights": {
"type": "boolean",
"default": true
}
}
}Examine Kerberos ticket requests and identify potential Golden Ticket or Silver Ticket attacks
{
"type": "object",
"required": [],
"properties": {
"time_range": {
"enum": [
"1h",
"4h",
"24h",
"7d"
],
"type": "string"
},
"ticket_type": {
"enum": [
"tgt",
"tgs",
"all"
],
"type": "string"
},
"suspicious_only": {
"type": "boolean",
"default": false
},
"service_principal": {
"type": "string"
}
}
}Review administrative actions performed by privileged accounts including object modifications and policy changes
{
"type": "object",
"required": [],
"properties": {
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d"
],
"type": "string"
},
"activity_types": {
"type": "array",
"items": {
"enum": [
"user_creation",
"user_modification",
"group_modification",
"gpo_changes",
"schema_changes",
"trust_changes",
"delegation_changes"
],
"type": "string"
}
},
"admin_accounts": {
"type": "array",
"items": {
"type": "string"
}
},
"target_objects": {
"type": "array",
"items": {
"type": "string"
}
},
"organizational_units": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Review high-risk administrative actions including schema changes, trust modifications, and GPO updates
{
"type": "object",
"required": [],
"properties": {
"risk_level": {
"enum": [
"critical",
"high",
"medium",
"all"
],
"type": "string"
},
"time_range": {
"enum": [
"1h",
"4h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"administrator": {
"type": "string"
},
"operation_type": {
"enum": [
"schema_change",
"trust_modification",
"gpo_update",
"ou_modification",
"delegation_change",
"all"
],
"type": "string"
}
}
}Create incident case for Active Directory security event with automated enrichment and assignment
{
"type": "object",
"required": [
"title",
"severity",
"category"
],
"properties": {
"title": {
"type": "string"
},
"category": {
"enum": [
"account_compromise",
"privilege_escalation",
"lateral_movement",
"data_exfiltration",
"malware",
"policy_violation"
],
"type": "string"
},
"severity": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
},
"auto_enrich": {
"type": "boolean",
"default": true
},
"affected_hosts": {
"type": "array",
"items": {
"type": "string"
}
},
"affected_users": {
"type": "array",
"items": {
"type": "string"
}
},
"assigned_analyst": {
"type": "string"
},
"initial_evidence": {
"type": "string"
}
}
}Hunt for lateral movement indicators across domain controllers and member servers using authentication logs
{
"type": "object",
"required": [],
"properties": {
"source_host": {
"type": "string"
},
"target_hosts": {
"type": "array",
"items": {
"type": "string"
}
},
"user_accounts": {
"type": "array",
"items": {
"type": "string"
}
},
"time_window_hours": {
"type": "integer",
"default": 24,
"maximum": 168,
"minimum": 1
},
"authentication_types": {
"type": "array",
"items": {
"enum": [
"kerberos",
"ntlm",
"negotiate"
],
"type": "string"
}
},
"include_service_accounts": {
"type": "boolean",
"default": false
}
}
}Immediately disable user account and revoke active sessions when compromise is detected
{
"type": "object",
"required": [
"account_id",
"reason"
],
"properties": {
"reason": {
"enum": [
"suspected_compromise",
"policy_violation",
"security_incident",
"administrative"
],
"type": "string"
},
"account_id": {
"type": "string"
},
"notify_admins": {
"type": "boolean",
"default": true
},
"revoke_sessions": {
"type": "boolean",
"default": true
}
}
}Retrieve comprehensive account information including group memberships, logon history, and security attributes
{
"type": "object",
"required": [
"account_id"
],
"properties": {
"account_id": {
"type": "string"
},
"include_groups": {
"type": "boolean",
"default": true
},
"sam_account_name": {
"type": "string"
},
"include_logon_history": {
"type": "boolean",
"default": true
}
}
}Retrieve recent modifications to security group memberships with change details and authorization context
{
"type": "object",
"required": [],
"properties": {
"group_dn": {
"type": "string"
},
"group_name": {
"type": "string"
},
"time_range": {
"enum": [
"1h",
"4h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"change_type": {
"enum": [
"added",
"removed",
"all"
],
"type": "string"
},
"privileged_groups_only": {
"type": "boolean",
"default": false
}
}
}Retrieve comprehensive risk assessment for a specific user including authentication patterns and privilege usage
{
"type": "object",
"required": [
"user_id"
],
"properties": {
"user_id": {
"type": "string"
},
"days_back": {
"type": "integer",
"default": 30,
"maximum": 365,
"minimum": 1
},
"sam_account_name": {
"type": "string"
},
"include_logon_history": {
"type": "boolean",
"default": true
},
"include_privilege_usage": {
"type": "boolean",
"default": true
}
}
}Search for indicators of lateral movement using pass-the-hash, pass-the-ticket, or credential dumping techniques
{
"type": "object",
"required": [
"technique"
],
"properties": {
"technique": {
"enum": [
"pass_the_hash",
"pass_the_ticket",
"credential_dumping",
"psexec",
"wmi",
"all"
],
"type": "string"
},
"time_range": {
"enum": [
"1h",
"4h",
"24h",
"7d"
],
"type": "string"
},
"source_host": {
"type": "string"
},
"target_hosts": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Search for Kerberoasting, Golden Ticket, and Silver Ticket attack indicators in authentication logs
{
"type": "object",
"required": [
"attack_types"
],
"properties": {
"time_range": {
"enum": [
"last_hour",
"last_24h",
"last_7d",
"last_30d"
],
"type": "string"
},
"target_spns": {
"type": "array",
"items": {
"type": "string"
}
},
"attack_types": {
"type": "array",
"items": {
"enum": [
"kerberoasting",
"golden_ticket",
"silver_ticket",
"asreproasting",
"dcsync"
],
"type": "string"
}
},
"suspicious_accounts": {
"type": "array",
"items": {
"type": "string"
}
},
"include_service_accounts": {
"type": "boolean",
"default": true
}
}
}Enumerate accounts with elevated privileges across domains including service accounts and administrative groups
{
"type": "object",
"required": [],
"properties": {
"domain": {
"type": "string"
},
"group_filter": {
"type": "string"
},
"privilege_level": {
"enum": [
"domain_admin",
"enterprise_admin",
"schema_admin",
"service_account",
"all"
],
"type": "string"
},
"include_disabled": {
"type": "boolean",
"default": false
}
}
}Validate domain trust relationships and detect unauthorized trust modifications or abuse
{
"type": "object",
"required": [],
"properties": {
"trust_type": {
"enum": [
"parent_child",
"external",
"forest",
"shortcut",
"unknown",
"all"
],
"type": "string",
"default": "all"
},
"trust_direction": {
"enum": [
"inbound",
"outbound",
"bidirectional",
"all"
],
"type": "string",
"default": "all"
},
"include_disabled": {
"type": "boolean",
"default": false
},
"check_sid_filtering": {
"type": "boolean",
"default": true
},
"validate_connectivity": {
"type": "boolean",
"default": true
}
}
}Isolate domain-joined computer from network access while maintaining domain trust for investigation
{
"type": "object",
"required": [
"computer_name",
"quarantine_level"
],
"properties": {
"computer_id": {
"type": "string"
},
"incident_id": {
"type": "string"
},
"computer_name": {
"type": "string"
},
"duration_hours": {
"type": "integer",
"default": 24
},
"quarantine_level": {
"enum": [
"network_isolation",
"domain_isolation",
"full_quarantine"
],
"type": "string"
}
}
}Disable user account and revoke active sessions to contain potential compromise
{
"type": "object",
"required": [
"user_id",
"reason"
],
"properties": {
"notes": {
"type": "string"
},
"reason": {
"enum": [
"suspected_compromise",
"policy_violation",
"investigation",
"administrative"
],
"type": "string"
},
"user_id": {
"type": "string"
},
"disable_account": {
"type": "boolean",
"default": true
},
"revoke_sessions": {
"type": "boolean",
"default": true
},
"sam_account_name": {
"type": "string"
}
}
}Search Active Directory security events using LDAP filters with time range and event type filtering
{
"type": "object",
"required": [
"ldap_filter"
],
"properties": {
"limit": {
"type": "integer",
"default": 100
},
"time_range": {
"enum": [
"1h",
"4h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"event_types": {
"type": "array",
"items": {
"enum": [
"logon",
"logoff",
"account_lockout",
"privilege_escalation",
"group_modification",
"password_change",
"kerberos_failure"
],
"type": "string"
}
},
"ldap_filter": {
"type": "string",
"description": "LDAP search filter"
},
"domain_controller": {
"type": "string"
}
}
}