loading…
This task focuses on investigating suspicious endpoint activity and containing threats using Endpoint Detection and Response capabilities. It covers suspicious process-tree investigation, ransomware canary investigation, living-off-the-land binary detection, USB malware quarantine, EDR tamper protection investigation, and fleet-wide IOC blocking. The objective is to identify malicious processes, understand how threats execute, contain compromised endpoints, and prevent known malicious files or activity from spreading across the environment. It helps security teams respond quickly to endpoint threats and maintain effective endpoint protection.
/api/mcp/srv-edr-endpoint-containmentMCP enable + token are only for calling from an external client — the playground below needs neither.
Isolate an endpoint from network communications while maintaining EDR agent connectivity
{
"type": "object",
"required": [
"endpoint_id",
"reason"
],
"properties": {
"reason": {
"type": "string"
},
"endpoint_id": {
"type": "string"
},
"notify_user": {
"type": "boolean",
"default": false
},
"allow_remediation": {
"type": "boolean",
"default": true
}
}
}Fetch detailed detection information including timeline, artifacts, and related events by detection ID
{
"type": "object",
"required": [
"detection_id"
],
"properties": {
"detection_id": {
"type": "string"
},
"include_timeline": {
"type": "boolean",
"default": true
},
"include_artifacts": {
"type": "boolean",
"default": true
}
}
}Retrieve detailed endpoint information including containment status, installed agents, and recent activity.
{
"type": "object",
"required": [
"endpoint_id"
],
"properties": {
"endpoint_id": {
"type": "string"
},
"include_network": {
"type": "boolean",
"default": false
},
"include_processes": {
"type": "boolean",
"default": false
}
}
}Retrieve detailed endpoint information including containment state, agent version, and system details
{
"type": "object",
"required": [
"endpoint_id"
],
"properties": {
"endpoint_id": {
"type": "string"
},
"include_processes": {
"type": "boolean",
"default": false
},
"include_network_connections": {
"type": "boolean",
"default": false
}
}
}Execute threat hunting queries across endpoint telemetry using YARA rules or IOC matching
{
"type": "object",
"required": [
"hunt_type",
"hunt_content"
],
"properties": {
"hunt_type": {
"enum": [
"yara",
"ioc",
"custom_query"
],
"type": "string"
},
"max_results": {
"type": "integer",
"default": 1000,
"maximum": 10000,
"minimum": 1
},
"hunt_content": {
"type": "string",
"description": "YARA rule, IOC list, or custom hunt query"
},
"endpoint_scope": {
"type": "array",
"items": {
"type": "string"
},
"description": "Specific endpoint IDs or empty for all"
}
}
}Retrieve all endpoints currently under network containment with isolation details and timestamps.
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 50
},
"analyst": {
"type": "string"
},
"start_time": {
"type": "string",
"format": "date-time"
},
"containment_type": {
"enum": [
"full_isolation",
"partial_isolation"
],
"type": "string"
}
}
}Retrieve active detections with filtering by status, severity, and assignment
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 1000,
"minimum": 1
},
"offset": {
"type": "integer",
"default": 0,
"minimum": 0
},
"status": {
"type": "array",
"items": {
"enum": [
"new",
"in_progress",
"resolved",
"false_positive"
],
"type": "string"
}
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low"
],
"type": "string"
}
},
"assigned_to": {
"type": "string"
}
}
}Enumerate managed endpoints with filtering by containment status, OS, and last seen time
{
"type": "object",
"required": [],
"properties": {
"limit": {
"type": "integer",
"default": 100,
"maximum": 1000,
"minimum": 1
},
"offset": {
"type": "integer",
"default": 0,
"minimum": 0
},
"os_family": {
"type": "array",
"items": {
"enum": [
"windows",
"macos",
"linux"
],
"type": "string"
}
},
"last_seen_hours": {
"type": "integer",
"minimum": 1
},
"containment_status": {
"type": "array",
"items": {
"enum": [
"contained",
"normal",
"pending"
],
"type": "string"
}
}
}
}Search security events across endpoints using KQL queries with time range and severity filters
{
"type": "object",
"required": [
"query"
],
"properties": {
"query": {
"type": "string",
"description": "KQL query string"
},
"end_time": {
"type": "string",
"format": "date-time"
},
"severity": {
"type": "array",
"items": {
"enum": [
"critical",
"high",
"medium",
"low",
"informational"
],
"type": "string"
}
},
"start_time": {
"type": "string",
"format": "date-time"
},
"time_range": {
"enum": [
"1h",
"6h",
"24h",
"7d",
"30d",
"custom"
],
"type": "string"
},
"endpoint_ids": {
"type": "array",
"items": {
"type": "string"
}
}
}
}Remove network isolation from a contained endpoint and restore normal connectivity
{
"type": "object",
"required": [
"endpoint_id",
"reason"
],
"properties": {
"reason": {
"type": "string"
},
"endpoint_id": {
"type": "string"
},
"notify_user": {
"type": "boolean",
"default": false
}
}
}Change detection status and assignment for incident response workflow management
{
"type": "object",
"required": [
"detection_id",
"status"
],
"properties": {
"status": {
"enum": [
"new",
"in_progress",
"resolved",
"false_positive"
],
"type": "string"
},
"assigned_to": {
"type": "string"
},
"detection_id": {
"type": "string"
},
"resolution_notes": {
"type": "string"
}
}
}