loading…
Detecting Kerberoasting, DCSync attacks, Golden Ticket usage, and anomalous privilege escalation in Active Directory.
/api/mcp/srv-active-directory-identity-defenseMCP enable + token are only for calling from an external client — the playground below needs neither.
Track and analyze Active Directory group membership modifications including privileged group changes, bulk modifications, and unauthorized access patterns
{
"type": "object",
"required": [],
"properties": {
"group_name": {
"type": "string"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"90d"
],
"type": "string"
},
"change_type": {
"type": "array",
"items": {
"enum": [
"member_added",
"member_removed",
"group_created",
"group_deleted",
"permissions_modified"
],
"type": "string"
}
},
"modified_by": {
"type": "string"
},
"include_nested_changes": {
"type": "boolean"
},
"privileged_groups_only": {
"type": "boolean"
}
}
}Detect suspicious Kerberos authentication patterns including ticket anomalies, encryption downgrades, and unusual service requests.
{
"type": "object",
"required": [],
"properties": {
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string",
"default": "24h"
},
"detection_type": {
"enum": [
"golden_ticket",
"silver_ticket",
"kerberoasting",
"asreproasting",
"encryption_downgrade",
"unusual_spn",
"all"
],
"type": "string",
"default": "all"
},
"target_identity": {
"type": "string",
"description": "Specific user or service account to analyze"
},
"confidence_threshold": {
"type": "number",
"default": 0.7,
"maximum": 1,
"minimum": 0.1
}
}
}Immediately disable user account, revoke active sessions, and block authentication for suspected compromised identities with optional automated remediation
{
"type": "object",
"required": [
"identity_id",
"identity_type",
"block_actions",
"reason"
],
"properties": {
"reason": {
"type": "string"
},
"identity_id": {
"type": "string"
},
"notify_user": {
"type": "boolean"
},
"block_actions": {
"type": "array",
"items": {
"enum": [
"disable_account",
"revoke_sessions",
"reset_password",
"block_authentication",
"quarantine_computer"
],
"type": "string"
}
},
"identity_type": {
"enum": [
"user",
"computer",
"service_account"
],
"type": "string"
},
"duration_hours": {
"type": "integer",
"maximum": 168,
"minimum": 1
},
"escalation_required": {
"type": "boolean"
}
}
}Identify Kerberos-based attacks including Kerberoasting, ASREPRoasting, Golden Ticket, and Silver Ticket activities with detailed attack indicators and affected assets
{
"type": "object",
"required": [],
"properties": {
"source_ip": {
"type": "string"
},
"target_spn": {
"type": "string"
},
"time_window": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"attack_types": {
"type": "array",
"items": {
"enum": [
"kerberoasting",
"asreproasting",
"golden_ticket",
"silver_ticket",
"dcsync",
"dcerpc_abuse",
"overpass_the_hash"
],
"type": "string"
}
},
"include_indicators": {
"type": "boolean"
},
"confidence_threshold": {
"enum": [
"low",
"medium",
"high"
],
"type": "string"
}
}
}Map potential attack paths from current user context to high-value targets using Active Directory relationships and permissions.
{
"type": "object",
"required": [
"source_identity"
],
"properties": {
"max_hops": {
"type": "integer",
"default": 5,
"maximum": 10,
"minimum": 1
},
"target_groups": {
"type": "array",
"items": {
"enum": [
"domain_admins",
"enterprise_admins",
"schema_admins",
"account_operators",
"backup_operators",
"custom"
],
"type": "string"
},
"default": [
"domain_admins"
]
},
"source_identity": {
"type": "string",
"description": "Starting point identity DN or SID"
},
"include_acl_paths": {
"type": "boolean",
"default": true
},
"include_group_paths": {
"type": "boolean",
"default": true
}
}
}List all privileged Active Directory accounts including domain admins, enterprise admins, and custom privileged groups with last activity and risk assessment
{
"type": "object",
"required": [],
"properties": {
"risk_threshold": {
"enum": [
"any",
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"include_inactive": {
"type": "boolean"
},
"privilege_levels": {
"type": "array",
"items": {
"enum": [
"domain_admin",
"enterprise_admin",
"schema_admin",
"account_operator",
"backup_operator",
"custom_privileged"
],
"type": "string"
}
},
"inactive_threshold_days": {
"type": "integer",
"maximum": 365,
"minimum": 1
},
"include_service_accounts": {
"type": "boolean"
}
}
}Get comprehensive risk assessment for a specific user, computer, or service account including behavioral analytics and threat indicators.
{
"type": "object",
"required": [
"identity_id"
],
"properties": {
"identity_id": {
"type": "string",
"description": "Distinguished name or SID of the identity"
},
"include_timeline": {
"type": "boolean",
"default": true
},
"include_permissions": {
"type": "boolean",
"default": true
},
"include_group_memberships": {
"type": "boolean",
"default": true
}
}
}Search for user accounts, service accounts, and computer objects across Active Directory using LDAP filters with risk scoring and anomaly detection.
{
"type": "object",
"required": [
"ldap_filter"
],
"properties": {
"scope": {
"enum": [
"users",
"computers",
"service_accounts",
"groups",
"all"
],
"type": "string",
"default": "all"
},
"time_range": {
"enum": [
"1h",
"24h",
"7d",
"30d",
"90d"
],
"type": "string",
"default": "24h"
},
"ldap_filter": {
"type": "string",
"description": "LDAP query filter"
},
"risk_threshold": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string",
"default": "medium"
},
"include_disabled": {
"type": "boolean",
"default": false
}
}
}Analyze authentication events for a specific identity to identify anomalous logon patterns, impossible travel, and credential usage indicators
{
"type": "object",
"required": [],
"properties": {
"time_window": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d"
],
"type": "string"
},
"anomaly_types": {
"type": "array",
"items": {
"enum": [
"impossible_travel",
"unusual_location",
"off_hours",
"failed_attempts",
"privilege_usage",
"lateral_movement"
],
"type": "string"
}
},
"computer_name": {
"type": "string"
},
"user_principal_name": {
"type": "string"
},
"include_related_events": {
"type": "boolean"
}
}
}Analyze authentication logs and network activity to detect and trace lateral movement patterns across Active Directory joined systems.
{
"type": "object",
"required": [],
"properties": {
"source_host": {
"type": "string",
"description": "Starting computer name or IP"
},
"target_identity": {
"type": "string",
"description": "User account to investigate"
},
"time_window_hours": {
"type": "integer",
"default": 24,
"maximum": 168,
"minimum": 1
},
"movement_techniques": {
"type": "array",
"items": {
"enum": [
"psexec",
"wmi",
"rdp",
"smb",
"winrm",
"dcom",
"scheduled_task"
],
"type": "string"
},
"default": [
"psexec",
"wmi",
"rdp"
]
},
"include_process_details": {
"type": "boolean",
"default": true
}
}
}Retrieve detected privilege escalation events with attack paths, affected accounts, and remediation recommendations.
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 1000,
"minimum": 1
},
"offset": {
"type": "integer",
"default": 0,
"minimum": 0
},
"status": {
"enum": [
"new",
"investigating",
"confirmed",
"false_positive",
"resolved"
],
"type": "string",
"default": "new"
},
"severity": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"technique": {
"enum": [
"kerberoasting",
"asreproasting",
"dcsync",
"golden_ticket",
"silver_ticket",
"delegation_abuse",
"acl_abuse"
],
"type": "string"
}
}
}Retrieve Active Directory security alerts filtered by severity, alert type, and affected identities with pagination support
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"maximum": 1000,
"minimum": 1
},
"offset": {
"type": "integer",
"minimum": 0
},
"status": {
"enum": [
"open",
"investigating",
"resolved",
"false_positive"
],
"type": "string"
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
}
},
"alert_types": {
"type": "array",
"items": {
"enum": [
"suspicious_logon",
"privilege_escalation",
"lateral_movement",
"credential_theft",
"account_manipulation",
"kerberoasting",
"dcsync"
],
"type": "string"
}
},
"affected_user": {
"type": "string"
},
"affected_computer": {
"type": "string"
}
}
}Track and alert on sensitive Active Directory operations performed by privileged accounts including schema changes and permission modifications.
{
"type": "object",
"required": [],
"properties": {
"time_range": {
"enum": [
"real_time",
"1h",
"6h",
"24h",
"7d"
],
"type": "string",
"default": "24h"
},
"operation_type": {
"enum": [
"schema_modification",
"permission_change",
"group_membership",
"password_reset",
"account_creation",
"delegation_change",
"all"
],
"type": "string",
"default": "all"
},
"alert_threshold": {
"type": "integer",
"default": 5,
"minimum": 1
},
"privileged_groups_only": {
"type": "boolean",
"default": true
},
"exclude_service_accounts": {
"type": "boolean",
"default": false
}
}
}Immediately disable account, revoke active sessions, and isolate associated endpoints for a confirmed compromised identity.
{
"type": "object",
"required": [
"identity_id",
"reason"
],
"properties": {
"reason": {
"enum": [
"confirmed_compromise",
"suspicious_activity",
"policy_violation",
"administrative"
],
"type": "string",
"default": "confirmed_compromise"
},
"identity_id": {
"type": "string",
"description": "Distinguished name or SID"
},
"notify_user": {
"type": "boolean",
"default": false
},
"duration_hours": {
"type": "integer",
"default": 24,
"maximum": 168,
"minimum": 1
},
"quarantine_scope": {
"enum": [
"account_only",
"account_and_endpoints",
"full_isolation"
],
"type": "string",
"default": "account_and_endpoints"
}
}
}Update the status and assign analyst to a detected identity-based security incident with investigation notes.
{
"type": "object",
"required": [
"incident_id",
"status"
],
"properties": {
"notes": {
"type": "string"
},
"status": {
"enum": [
"new",
"assigned",
"investigating",
"escalated",
"resolved",
"false_positive"
],
"type": "string"
},
"priority": {
"enum": [
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"assigned_to": {
"type": "string",
"description": "Analyst username or email"
},
"incident_id": {
"type": "string"
},
"remediation_actions": {
"type": "array",
"items": {
"enum": [
"disable_account",
"reset_password",
"revoke_permissions",
"isolate_computer",
"force_logout"
],
"type": "string"
}
}
}
}