loading…
| tool | variants | description |
|---|---|---|
| active__analyze_group_membership_changes | 0 | Track and analyze Active Directory group membership modifications including privileged group changes, bulk modifications, and unauthorized access patterns |
| active__analyze_kerberos_anomalies | 0 | Detect suspicious Kerberos authentication patterns including ticket anomalies, encryption downgrades, and unusual service requests. |
| active__block_compromised_identity | 0 | Immediately disable user account, revoke active sessions, and block authentication for suspected compromised identities with optional automated remediation |
| active__detect_kerberos_attacks | 0 | Identify Kerberos-based attacks including Kerberoasting, ASREPRoasting, Golden Ticket, and Silver Ticket activities with detailed attack indicators and affected assets |
| active__enumerate_attack_paths | 0 | Map potential attack paths from current user context to high-value targets using Active Directory relationships and permissions. |
| active__enumerate_privileged_accounts | 0 | List all privileged Active Directory accounts including domain admins, enterprise admins, and custom privileged groups with last activity and risk assessment |
| active__get_identity_risk_profile | 0 | Get comprehensive risk assessment for a specific user, computer, or service account including behavioral analytics and threat indicators. |
| active__hunt_identities | 0 | Search for user accounts, service accounts, and computer objects across Active Directory using LDAP filters with risk scoring and anomaly detection. |
| active__investigate_authentication_anomaly | 0 | Analyze authentication events for a specific identity to identify anomalous logon patterns, impossible travel, and credential usage indicators |
| active__investigate_lateral_movement | 0 | Analyze authentication logs and network activity to detect and trace lateral movement patterns across Active Directory joined systems. |
| active__list_privilege_escalations | 0 | Retrieve detected privilege escalation events with attack paths, affected accounts, and remediation recommendations. |
| active__list_security_alerts | 0 | Retrieve Active Directory security alerts filtered by severity, alert type, and affected identities with pagination support |
| active__monitor_privileged_operations | 0 | Track and alert on sensitive Active Directory operations performed by privileged accounts including schema changes and permission modifications. |
| active__quarantine_compromised_identity | 0 | Immediately disable account, revoke active sessions, and isolate associated endpoints for a confirmed compromised identity. |
| active__triage_security_incident | 0 | Update the status and assign analyst to a detected identity-based security incident with investigation notes. |
| tool | variants | description |
|---|---|---|
| active__analyze_group_permissions | 0 | Audit group membership hierarchy and effective permissions for security groups and distribution lists |
| active__analyze_kerberos_tickets | 0 | Examine Kerberos ticket requests and identify potential Golden Ticket or Silver Ticket attacks |
| active__audit_admin_activities | 0 | Review administrative actions performed by privileged accounts including object modifications and policy changes |
| active__audit_privileged_operations | 0 | Review high-risk administrative actions including schema changes, trust modifications, and GPO updates |
| active__create_security_incident | 0 | Create incident case for Active Directory security event with automated enrichment and assignment |
| active__detect_lateral_movement |
| tool | variants | description |
|---|---|---|
| ai__assess_model_robustness | 0 | Assess AI model robustness across multiple attack vectors with automated testing suite and compliance scoring. |
| ai__create_engagement | 0 | Create new red team engagement targeting specific AI systems with defined scope, timeline, and success criteria. |
| ai__execute_adversarial_test | 0 | Execute adversarial test case against target AI model with specified attack technique and payload configuration. |
| ai__generate_attack_payload | 0 | Generate adversarial attack payload using specified technique against target model architecture with evasion constraints. |
| ai__get_exploit_by_id | 0 | Retrieve detailed exploit information including payload, prerequisites, and mitigation strategies by exploit ID. |
| ai__hunt_model_anomalies |
| tool | variants | description |
|---|---|---|
| api__configure_policy | 0 | Define and update API security policies for authentication requirements, rate limiting, and data protection controls |
| api__create_security_policy | 0 | Create or update API security policies with rate limiting, access controls, and data protection rules |
| api__export_compliance_report | 0 | Generate compliance reports for API security posture against frameworks like OWASP API Top 10, PCI DSS, or SOC 2 |
| api__generate_security_report | 0 | Create comprehensive API security assessment reports with executive summaries, technical findings, and remediation roadmaps |
| api__generate_traffic_baseline | 0 | Analyze API traffic patterns to establish behavioral baselines for anomaly detection |
| api__get_endpoint_details |
| tool | variants | description |
|---|---|---|
| application__create_security_policy | 0 | Define security scanning policies with vulnerability thresholds, scan schedules, and enforcement rules for application security governance |
| application__generate_compliance_report | 0 | Generate compliance assessment report for specified applications against security frameworks like PCI DSS, SOX, or OWASP standards |
| application__get_scan_results | 0 | Retrieve detailed scan results including vulnerability findings, scan metrics, code quality issues, and dependency analysis for a completed security scan |
| application__get_vulnerability | 0 | Retrieve detailed vulnerability information including CVSS vector, CWE mapping, proof of concept, remediation guidance, and affected code locations |
| application__list_applications | 0 | Retrieve applications in the portfolio with filtering by business unit, technology stack, risk score, and compliance requirements |
| tool | variants | description |
|---|---|---|
| cloud__create_security_case | 0 | Create new security investigation case with initial evidence, severity classification, and assignment to security team |
| cloud__create_security_exception | 0 | Create security finding exception with justification and expiration for approved risk acceptance |
| cloud__create_suppression_rule | 0 | Create suppression rule to automatically suppress false positive alerts based on resource attributes, user context, or finding patterns |
| cloud__execute_response_playbook | 0 | Execute automated incident response playbook for containment, investigation, and remediation actions |
| cloud__get_compliance_posture | 0 | Retrieve current security compliance posture summary with control status across specified frameworks and cloud accounts |
| cloud__get_incident_details |
| tool | variants | description |
|---|---|---|
| credential__analyze_exfiltration | 0 | Analyze credential exfiltration patterns and generate risk assessment with recommended mitigations |
| credential__block_exfiltration | 0 | Execute automated containment actions to block active credential exfiltration attempts |
| credential__create_watchlist | 0 | Create monitoring watchlist for high-risk accounts, systems, or credential stores |
| credential__export_forensics | 0 | Export credential exfiltration forensic evidence package with chain of custody for legal proceedings |
| credential__get_incident | 0 | Retrieve detailed credential exfiltration incident by ID including timeline, artifacts, and investigation notes |
| credential__hunt_indicators |
| tool | variants | description |
|---|---|---|
| data__aggregate_access_metrics | 0 | Generate aggregated metrics on data access patterns, policy compliance, and security posture across time periods and organizational units |
| data__approve_access_request | 0 | Approve or deny pending access request with optional conditions and expiration settings |
| data__classify_data_asset | 0 | Apply or update data classification labels on datasets, tables, or files based on content analysis and organizational policies |
| data__create_data_incident | 0 | Create new data security incident from detected violation or manual report with initial classification and assignment |
| data__get_access_request | 0 | Retrieve detailed access request by ID including approval workflow, justification, and current status |
| data__get_access_session |
| tool | variants | description |
|---|---|---|
| data__create_exception | 0 | Create policy exception for specific users, content patterns, or destinations to reduce false positives |
| data__generate_compliance_report | 0 | Generate compliance reports for regulatory frameworks with incident summaries, policy effectiveness, and risk metrics |
| data__get_incident | 0 | Retrieve detailed incident information including matched content, policy violations, user context, and remediation actions |
| data__get_policy | 0 | Retrieve DLP policy configuration including rules, conditions, and enforcement actions |
| data__get_policy_coverage | 0 | Analyze policy coverage across data repositories, users, and channels showing gaps and overlaps |
| data__list_policies |
| tool | variants | description |
|---|---|---|
| ddos__get_attack_details | 4 | Get detailed metrics and logs for a specific attack campaign by attack ID |
| ddos__get_bot_status | 4 | Retrieve health and connectivity status for individual bots within a botnet |
| ddos__launch_attack | 4 | Initiate a distributed denial of service attack against specified targets using configured botnet resources |
| ddos__list_active_attacks | 4 | Retrieve currently running attack campaigns with status and performance metrics |
| ddos__list_botnets | 4 | Enumerate available botnet resources with bot counts and geographic distribution |
| ddos__schedule_attack | 4 | Queue a future attack campaign with specified timing and escalation parameters |
| tool | variants | description |
|---|---|---|
| detection__create_hunt | 0 | Create a new threat hunt with hypothesis, search queries, and target data sources |
| detection__get_detection | 0 | Retrieve a specific detection rule by ID including metadata, logic, and test cases |
| detection__get_notable_event | 0 | Retrieve a specific notable event by ID including raw events, enrichment data, and investigation timeline |
| detection__list_detections | 0 | List detection rules with filters for status, severity, data source, and MITRE ATT&CK techniques |
| detection__list_indicators | 0 | List threat intelligence indicators with filters for type, source, confidence, and expiration status |
| detection__list_notable_events | 0 |
| tool | variants | description |
|---|---|---|
| devsecops__approve_exception | 0 | Grant security exception or risk acceptance for specific findings with approval workflow and expiration tracking |
| devsecops__generate_compliance_report | 0 | Create compliance assessment report against specified frameworks with evidence collection and gap analysis |
| devsecops__get_scan_report | 0 | Retrieve detailed scan report by scan ID including all findings, metrics, and remediation recommendations |
| devsecops__list_pipelines | 0 | Enumerate CI/CD pipelines with security gate status, policy violations, and scan integration details |
| devsecops__list_policies | 0 | Retrieve security policies and compliance rules configured across repositories, pipelines, and infrastructure with enforcement status |
| devsecops__query_findings |
| tool | variants | description |
|---|---|---|
| dlp__block_user_action | 0 | Block user from performing data transfer actions like email, file sharing, or removable media based on risk assessment. |
| dlp__create_incident | 0 | Create a new DLP incident from one or more related violations for investigation and response |
| dlp__create_policy_exception | 0 | Create temporary or permanent policy exception for legitimate business use cases with approval workflow and audit logging. |
| dlp__generate_forensic_report | 0 | Generate comprehensive forensic report for DLP incident including timeline, evidence chain, policy violations, and recommended remediation actions. |
| dlp__get_incident | 0 | Retrieve detailed DLP incident by ID including policy violations, matched content snippets, user context, and remediation actions taken. |
| tool | variants | description |
|---|---|---|
| edr__contain_endpoint | 0 | Isolate an endpoint from network communications while maintaining EDR agent connectivity |
| edr__get_detection | 0 | Fetch detailed detection information including timeline, artifacts, and related events by detection ID |
| edr__get_endpoint | 0 | Retrieve detailed endpoint information including containment status, installed agents, and recent activity. |
| edr__get_endpoint_status | 0 | Retrieve detailed endpoint information including containment state, agent version, and system details |
| edr__hunt_threats | 0 | Execute threat hunting queries across endpoint telemetry using YARA rules or IOC matching |
| edr__list_contained_endpoints | 0 |
| tool | variants | description |
|---|---|---|
| email__analyze_attachment | 0 | Submit email attachment for deep malware analysis and threat detection |
| email__analyze_url | 0 | Submit URL for reputation analysis and threat detection using security engines |
| email__block_sender | 0 | Add sender email address or domain to block list with specified block type and duration |
| email__create_dlp_incident | 0 | Create data loss prevention incident for email containing sensitive data |
| email__get_incident | 0 | Retrieve email security incident details including related messages, timeline, and response actions |
| email__get_message | 0 | Retrieve detailed message information including headers, body, attachments, and threat analysis results |
| tool | variants | description |
|---|---|---|
| endpoint__get_detection | 0 | Retrieve detailed information for a specific detection by detection ID |
| endpoint__get_host_details | 0 | Get comprehensive host information including installed agents, policies, and recent activity |
| endpoint__hunt_threats | 0 | Execute threat hunting query across endpoint telemetry with IOC matching |
| endpoint__isolate_host | 0 | Isolate an endpoint from network access while maintaining management connectivity |
| endpoint__list_detections | 0 | List active detections with filtering by status, severity, and detection type |
| endpoint__list_policies | 0 | List endpoint protection policies with deployment status and host assignments |
| tool | variants | description |
|---|---|---|
| env__assign_item | 4 | Assign item by id. |
| env__create_item | 4 | Create item. |
| env__delete_item | 4 | Delete item by id. |
| env__export_items | 4 | Export items. |
| env__get_item | 4 | Get item by id. |
| env__list_items | 4 | List items. |
| env__notify_owner | 4 | Notify owner by id. |
| tool | variants | description |
|---|---|---|
| excessive__create_investigation | 0 | Initialize new security investigation case with initial scope, assigned analysts, and evidence collection parameters |
| excessive__enrich_artifacts | 0 | Enhance investigation artifacts with external threat intelligence, sandbox analysis, and reputation data from integrated security tools |
| excessive__generate_iocs | 0 | Extract and validate indicators of compromise from investigation artifacts to create actionable threat intelligence for detection rules |
| excessive__get_case | 0 | Fetch detailed case information including timeline, evidence artifacts, and investigation notes by case identifier |
| excessive__hunt_threats | 0 | Execute threat hunting queries across endpoint telemetry and network logs to identify suspicious activities and potential IOCs |
| tool | variants | description |
|---|---|---|
| hugging__create_detection_rule | 4 | Create automated detection rule for identifying malicious patterns in Hugging Face repositories |
| hugging__extract_indicators | 4 | Extract and analyze IOCs from model files including suspicious URLs, IP addresses, and embedded payloads |
| hugging__get_model_analysis | 4 | Retrieve detailed security analysis for a specific model including scan results, behavioral analysis, and risk assessment |
| hugging__get_threat_intelligence | 4 | Retrieve threat intelligence feed for known malicious authors, repositories, and attack patterns targeting Hugging Face |
| hugging__hunt_similar_threats | 4 | Search for models and repositories with similar threat patterns using behavioral and content similarity |
| hugging__list_suspicious_repos |
| tool | variants | description |
|---|---|---|
| identity__aggregate_risk_metrics | 0 | Generate risk analytics and metrics for identity governance including access sprawl, review completion rates, and violation trends |
| identity__analyze_access_patterns | 0 | Analyze user access patterns and identify anomalies or excessive privileges for risk assessment |
| identity__bulk_certify_access | 0 | Process multiple certification decisions in batch with validation and rollback capability |
| identity__certify_access | 0 | Record reviewer decision on access review items with justification and effective date |
| identity__detect_violations | 0 | Run policy violation detection across accounts and entitlements for SOD conflicts, excessive privileges, and dormant accounts |
| identity__escalate_review |
| tool | variants | description |
|---|---|---|
| identity__aggregate_threat_metrics | 0 | Generate threat intelligence metrics and trends for identity-based attacks across specified time periods and organizational units |
| identity__create_investigation | 0 | Create new identity threat investigation case with assigned analyst, priority level, and initial evidence collection |
| identity__create_watchlist_entry | 0 | Add user, group, or service account to identity monitoring watchlist with specific monitoring rules and alert thresholds |
| identity__disable_account | 0 | Disable user account immediately for security containment with reason code and analyst authorization |
| identity__get_detection | 0 | Fetch detailed information for a specific identity threat detection including timeline, affected entities, and investigation notes |
| tool | variants | description |
|---|---|---|
| incident__add_artifact | 0 | Add evidence artifact to incident case including files, network captures, memory dumps, or forensic images |
| incident__create_case | 0 | Create new incident case from security events, alerts, or manual reporting with initial triage classification |
| incident__escalate_case | 0 | Escalate incident case to higher tier analyst or external teams with escalation reason and urgency level |
| incident__get_case | 0 | Retrieve detailed incident case information including timeline, artifacts, notes, and related events by case ID |
| incident__hunt_threats | 0 | Execute threat hunting query across endpoints and network data using YARA rules, Sigma rules, or custom hunt logic |
| incident__list_cases |
| tool | variants | description |
|---|---|---|
| insider__add_evidence | 0 | Add digital evidence artifact to investigation case with chain of custody metadata and evidence classification |
| insider__create_case | 0 | Create new insider risk investigation case from alerts or manual initiation with employee subject and initial classification |
| insider__create_watchlist_entry | 0 | Add user to insider risk watchlist with monitoring parameters and justification |
| insider__escalate_case | 0 | Escalate an insider risk case to higher priority level or different team with justification |
| insider__generate_risk_report | 0 | Generate comprehensive insider risk assessment report for user, department, or organization |
| insider__get_case |
| tool | variants | description |
|---|---|---|
| k8s__assess_rbac_risks | 0 | Analyze RBAC configurations for privilege escalation risks, excessive permissions, and compliance violations |
| k8s__audit_rbac_permissions | 0 | Analyzes Kubernetes RBAC configurations to identify overprivileged accounts, unused permissions, and potential privilege escalation paths |
| k8s__create_security_incident | 0 | Create and track security incident from detected threats or policy violations |
| k8s__detect_runtime_threats | 0 | Queries runtime security events and behavioral anomalies across Kubernetes workloads using detection rules and ML models |
| k8s__generate_compliance_report | 0 | Generate compliance reports for security frameworks like CIS Kubernetes Benchmark, NSA/CISA guidelines, or SOC2 |
| k8s__get_compliance_report |
| tool | variants | description |
|---|---|---|
| llm__analyze_prompt | 0 | Submit suspicious prompt for behavioral analysis and threat classification |
| llm__create_detection | 0 | Deploy new detection rule for LLM attack patterns with custom logic and alerting thresholds |
| llm__export_forensics | 0 | Generate forensic package with attack artifacts, conversation logs, and timeline for incident response |
| llm__get_attack | 0 | Retrieve detailed attack analysis including IOCs, TTPs, and mitigation recommendations by attack ID |
| llm__get_indicators | 0 | Retrieve threat indicators including malicious prompt patterns, adversary signatures, and behavioral IOCs |
| llm__hunt_techniques | 0 |
| tool | variants | description |
|---|---|---|
| malware__classify_sample | 0 | Update malware family classification, threat level, and analyst notes for reviewed samples |
| malware__generate_iocs | 0 | Extract and generate indicators of compromise from analyzed samples including file hashes, network indicators, and behavioral signatures |
| malware__get_sample | 0 | Retrieve detailed analysis results for a specific malware sample including static analysis, dynamic behavior, and YARA rule matches |
| malware__hunt_indicators | 0 | Execute threat hunting queries across sample repository using YARA rules, behavioral patterns, or custom IOC signatures |
| malware__list_campaigns | 0 | List active malware campaigns with associated threat actor attribution, TTPs, and sample counts |
| malware__list_detections |
| tool | variants | description |
|---|---|---|
| mfa__analyze_risk_patterns | 0 | Generate risk analysis report identifying suspicious authentication patterns, anomalous locations, and potential compromise indicators |
| mfa__bypass_user_mfa | 0 | Create temporary MFA bypass for user with expiration time and justification for emergency access scenarios |
| mfa__enroll_authenticator | 0 | Initiate MFA authenticator enrollment for a user with specified device type and delivery method |
| mfa__enroll_user_method | 0 | Enroll a user in a new MFA method and generate enrollment data |
| mfa__generate_bypass_code | 0 | Generate temporary bypass codes for users experiencing MFA issues |
| mfa__get_authentication_event | 0 |
| tool | variants | description |
|---|---|---|
| network__block_indicator | 0 | Add IOC to blocklist across security controls with expiration and justification |
| network__create_case | 0 | Create new investigation case from alerts, events, or manual initiation with initial classification |
| network__get_alert | 0 | Fetch detailed alert information by alert ID including enrichment data and investigation timeline |
| network__get_asset_context | 0 | Retrieve asset information and risk context including criticality, vulnerabilities, and recent activity |
| network__get_incident | 0 | Retrieve incident details by incident ID including timeline, artifacts, and current assignment |
| network__get_threat_intelligence | 0 |
| tool | variants | description |
|---|---|---|
| network__block_indicator | 0 | Add indicator to block list across security controls, creates enforcement rules in firewalls and proxies |
| network__create_case | 0 | Create new incident case with title, severity, assigned analyst, and initial evidence artifacts |
| network__generate_report | 0 | Generate security report with metrics, top threats, and case summaries for specified time period and report type |
| network__get_asset_profile | 0 | Retrieve asset security profile by IP or hostname including vulnerability scan results, network activity, and risk score |
| network__get_detection | 0 | Retrieve detection rule details by detection ID including rule logic, metadata, and recent trigger history |
| network__hunt_threats |
| tool | variants | description |
|---|---|---|
| privileged__approve_access_request | 0 | Approve or deny a pending privileged access request with workflow decision and comments. |
| privileged__approve_request | 0 | Approve or deny privileged access requests with workflow integration and audit trail |
| privileged__checkout_account | 0 | Check out a privileged account from the vault for authorized use with justification and duration. |
| privileged__checkout_password | 0 | Check out a managed password for a privileged account with approval workflow integration |
| privileged__generate_compliance_report | 0 | Generate compliance audit report for privileged access activities covering specified systems and time period. |
| privileged__generate_report |
| tool | variants | description |
|---|---|---|
| prompt__analyze_bypass | 0 | Perform deep analysis of potential prompt injection bypass attempts using semantic similarity and adversarial detection |
| prompt__create_safeguard | 0 | Deploy new prompt safeguard policy with input validation rules and output filtering controls |
| prompt__export_incidents | 0 | Generate comprehensive incident report for prompt injection events with forensic details and mitigation timeline |
| prompt__get_detection | 0 | Fetch detailed prompt injection detection event by detection_id including full payload and mitigation actions taken |
| prompt__list_detections | 0 | Retrieve prompt injection detection events with filtering by time range, severity, and attack type |
| prompt__quarantine_session |
| tool | variants | description |
|---|---|---|
| saas__analyze_user_risk | 0 | Calculate user risk score based on access patterns, privilege changes, and behavioral anomalies across connected SaaS applications |
| saas__create_incident | 0 | Create a security incident from one or more alerts for coordinated response and tracking |
| saas__get_alert | 0 | Retrieve detailed information for a specific security alert including evidence, affected users, and remediation recommendations |
| saas__get_posture_assessment | 0 | Retrieve security configuration assessment for a SaaS application including misconfigurations, compliance gaps, and remediation guidance |
| saas__get_risk_assessment | 0 | Retrieve comprehensive risk assessment for a SaaS application including security posture, compliance status, and risk metrics |
| saas__hunt_threats |
| tool | variants | description |
|---|---|---|
| secrets__generate_compliance_report | 0 | Generate compliance report for secrets management practices across specified scope and frameworks |
| secrets__get_detection | 0 | Retrieve detailed information about a specific secret detection including file location, matched pattern, and remediation guidance |
| secrets__list_detections | 0 | List secret detections with filtering by severity, status, repository, detection type, and time range |
| secrets__list_policy_violations | 0 | List policy violations for secrets management including expired credentials, weak entropy, and compliance failures |
| secrets__monitor_exposure | 0 | Monitor external sources and dark web for exposed organizational secrets and credentials |
| secrets__rotate_credential |
| tool | variants | description |
|---|---|---|
| securityteam__block_indicator | 4 | Add IOC to blocking lists across security controls with expiration and justification |
| securityteam__create_hunting_query | 4 | Create new threat hunting query with KQL/SPL syntax and schedule for continuous monitoring |
| securityteam__escalate_incident | 4 | Escalate incident priority and notify on-call team with escalation reason |
| securityteam__generate_ioc_report | 4 | Generate comprehensive IOC analysis report with prevalence, attribution, and recommended actions |
| securityteam__get_asset_risk_profile | 4 | Retrieve asset security posture including vulnerabilities, exposure score, and recent security events |
| securityteam__get_incident_details |
| tool | variants | description |
|---|---|---|
| siem__analyze_rule_performance | 4 | Analyze detection rule performance metrics including trigger frequency, false positive rate, and resource usage |
| siem__create_correlation_rule | 4 | Create new correlation rule with search logic, triggering conditions, and notable event configuration |
| siem__get_detection | 4 | Retrieve a specific detection rule by ID including logic, metadata, and correlation settings |
| siem__get_notable_event | 4 | Retrieve detailed notable event by event_id including triggering events, rule context, and investigation timeline |
| siem__hunt_threats | 4 | Execute threat hunting query across historical data with pivot capabilities and IOC enrichment |
| siem__list_detections |
| tool | variants | description |
|---|---|---|
| soc__create_case | 4 | Create investigation case from one or more alerts with initial classification |
| soc__enrich_artifact | 4 | Enrich security artifact with threat intelligence, reputation scores, and contextual information |
| soc__enrich_indicators | 0 | Enrich IOCs with threat intelligence from configured feeds and reputation sources |
| soc__execute_playbook | 0 | Execute SOAR playbook against specified alert or case with optional parameter overrides |
| soc__get_alert | 0 | Retrieve detailed alert information including events, artifacts, and investigation timeline |
| soc__get_dashboard_metrics | 0 | Retrieve SOC operational metrics including MTTD, MTTR, alert volume, and analyst workload |
| tool | variants | description |
|---|---|---|
| supply__aggregate_portfolio_metrics | 0 | Calculate portfolio-wide risk metrics and KPIs across supplier categories and geographic regions |
| supply__escalate_risk_incident | 0 | Escalate supplier risk incident to appropriate stakeholders and update incident status |
| supply__generate_compliance_report | 0 | Generate regulatory compliance report for specified frameworks and supplier portfolio |
| supply__get_supplier_profile | 0 | Fetch complete supplier profile including risk metrics, certifications, contract details, and relationship history |
| supply__initiate_supplier_audit | 0 | Schedule and initiate supplier audit workflow with defined scope and audit team assignment |
| supply__list_risk_assessments |
| tool | variants | description |
|---|---|---|
| threat__analyze_ttp | 0 | Analyze tactics, techniques, and procedures (TTPs) from MITRE ATT&CK framework against organizational telemetry and detection coverage |
| threat__create_detection_rule | 0 | Create a new detection rule from threat hunting findings with MITRE ATT&CK mapping and alert configuration |
| threat__create_hunt | 0 | Initialize new threat hunt campaign with hypothesis, tactics, techniques, and data sources to investigate |
| threat__enrich_indicators | 0 | Enrich indicators with threat intelligence context, reputation scores, attribution, and related campaigns from multiple feeds |
| threat__enrich_with_osint | 0 | Enrich indicators and entities with open source threat intelligence from multiple feeds including reputation scores and attribution data |
| threat__execute_hunt |
| tool | variants | description |
|---|---|---|
| vulnerability__aggregate_metrics | 0 | Calculate vulnerability metrics and KPIs including MTTR, SLA compliance, and risk trends by time period and grouping |
| vulnerability__aggregate_risk_metrics | 0 | Generate vulnerability risk metrics aggregated by asset groups, time periods, or organizational units |
| vulnerability__create_exception | 0 | Create vulnerability exception with business justification and approval workflow for accepted risks |
| vulnerability__create_remediation_ticket | 0 | Create remediation ticket in integrated ITSM system with vulnerability details, affected assets, and SLA requirements |
| vulnerability__export_report | 0 | Generate and export vulnerability assessment reports in specified formats with custom filtering and compliance mappings |
| tool | variants | description |
|---|---|---|
| vulnerability__create_exception | 0 | Create vulnerability exception with business justification and expiration date for risk acceptance |
| vulnerability__generate_report | 0 | Generate vulnerability assessment reports with executive summaries, trend analysis, SLA metrics, and compliance mappings |
| vulnerability__generate_risk_report | 0 | Generate executive risk reports with SLA metrics, trending analysis, and compliance status |
| vulnerability__get_asset | 0 | Retrieve comprehensive asset details including installed software, vulnerability summary, scan history, and configuration details |
| vulnerability__get_asset_vulnerabilities | 0 | Get all vulnerabilities for a specific asset with scan history and patch status |
| vulnerability__get_scan_results |
| tool | variants | description |
|---|---|---|
| wazuh__aggregate_alerts_by_rule | 0 | Generate alert statistics grouped by rule ID, severity, or agent over specified time period |
| wazuh__analyze_file_integrity | 0 | Analyze file integrity monitoring events for specific files or directories across agents with change detection and baseline comparison |
| wazuh__create_case | 0 | Create investigation case from alerts or manual input with assigned analyst and priority level |
| wazuh__create_custom_rule | 0 | Create a new custom detection rule with conditions, severity level, and alert configuration |
| wazuh__create_incident | 0 | Create security incident from one or more alerts with severity assignment, analyst assignment, and initial notes |
| wazuh__deploy_active_response |
| 0 |
| Hunt for lateral movement indicators across domain controllers and member servers using authentication logs |
| active__disable_compromised_account | 0 | Immediately disable user account and revoke active sessions when compromise is detected |
| active__get_account_details | 0 | Retrieve comprehensive account information including group memberships, logon history, and security attributes |
| active__get_group_membership_changes | 0 | Retrieve recent modifications to security group memberships with change details and authorization context |
| active__get_user_risk_profile | 0 | Retrieve comprehensive risk assessment for a specific user including authentication patterns and privilege usage |
| active__hunt_lateral_movement | 0 | Search for indicators of lateral movement using pass-the-hash, pass-the-ticket, or credential dumping techniques |
| active__investigate_kerberos_attacks | 0 | Search for Kerberoasting, Golden Ticket, and Silver Ticket attack indicators in authentication logs |
| active__list_privileged_accounts | 0 | Enumerate accounts with elevated privileges across domains including service accounts and administrative groups |
| active__monitor_domain_trusts | 0 | Validate domain trust relationships and detect unauthorized trust modifications or abuse |
| active__quarantine_suspicious_host | 0 | Isolate domain-joined computer from network access while maintaining domain trust for investigation |
| active__quarantine_user_account | 0 | Disable user account and revoke active sessions to contain potential compromise |
| active__query_security_events | 0 | Search Active Directory security events using LDAP filters with time range and event type filtering |
| 0 |
| Hunt for suspicious model behavior patterns using behavioral analytics and statistical deviation detection across inference logs. |
| ai__list_attack_scenarios | 0 | List red team attack scenarios filtered by target AI system type, attack phase, or business impact level. |
| ai__query_vulnerabilities | 0 | Search AI agent vulnerabilities by attack vector, severity, or MITRE ATT&CK technique with filters for model type and deployment environment. |
| ai__triage_finding | 0 | Triage security finding by updating severity, assigning owner, and setting remediation priority based on AI system criticality. |
| 0 |
| Retrieve comprehensive details for a specific API endpoint including schema, authentication requirements, and security posture |
| api__get_vulnerability | 0 | Retrieve detailed vulnerability information including proof of concept, remediation guidance, and affected endpoints |
| api__list_vulnerabilities | 0 | Retrieve API security vulnerabilities filtered by severity, OWASP category, or endpoint |
| api__monitor_traffic | 0 | Analyze API traffic patterns for anomalies, rate limiting violations, and suspicious request patterns |
| api__query_api_logs | 0 | Search API access logs and security events using filters for endpoints, IPs, status codes, and time ranges |
| api__scan_endpoints | 0 | Discover and inventory API endpoints from target hosts, domains, or networks with optional authentication |
| api__search_incidents | 0 | Query API security incidents and breaches with filtering by attack vectors, affected assets, and timeline |
| api__test_authentication | 0 | Validate API authentication mechanisms and test for common authentication bypasses |
| api__triage_incident | 0 | Update the status and priority of API security incidents with analyst notes and remediation actions |
| api__update_risk_score | 0 | Modify vulnerability risk scores based on business context, exploitability, and environmental factors |
| application__query_vulnerabilities | 0 | Search and filter vulnerabilities across applications using CVSS scores, CWE categories, application tags, and remediation status |
| application__scan_vulnerability | 0 | Initiate a security scan against an application or application component to identify vulnerabilities, misconfigurations, and security weaknesses |
| application__track_remediation_sla | 0 | Monitor and report on vulnerability remediation SLA compliance across applications with breach notifications and escalation triggers |
| application__triage_vulnerability | 0 | Update vulnerability status, assign ownership, set remediation timeline, and add triage notes for vulnerability management workflow |
| 0 |
| Retrieve detailed incident information including timeline, affected resources, and investigation notes by incident ID |
| cloud__get_security_incident | 0 | Retrieve detailed security incident information including timeline, affected resources, and investigation notes by incident ID |
| cloud__hunt_threat_indicators | 0 | Execute threat hunting query across cloud logs and telemetry using IOCs, TTPs, and behavioral patterns |
| cloud__hunt_threats | 0 | Create and execute threat hunting query across cloud telemetry data using MITRE ATT&CK techniques and IOCs |
| cloud__investigate_user_activity | 0 | Analyze user behavior and access patterns across cloud services to detect anomalous activity and privilege abuse |
| cloud__list_active_alerts | 0 | Retrieve active security alerts with filtering by status, assignee, and alert type |
| cloud__list_security_findings | 0 | List security findings with pagination, filtering by compliance framework, resource type, and remediation status |
| cloud__list_security_posture | 0 | List security posture scores and compliance status across cloud accounts and regions |
| cloud__list_threat_detections | 0 | List active threat detections and security alerts with filtering by detection type, threat actor, and confidence level |
| cloud__query_security_events | 0 | Search security events across cloud infrastructure using KQL or custom filters with time range and severity filtering |
| cloud__query_security_logs | 0 | Query cloud security logs using KQL syntax across CloudTrail, VPC Flow Logs, and security service logs |
| cloud__remediate_security_finding | 0 | Execute automated remediation action for security finding such as isolating resources, revoking permissions, or applying security policies |
| cloud__run_compliance_scan | 0 | Execute compliance scan against cloud resources for specified frameworks and generate assessment report |
| cloud__scan_cloud_assets | 0 | Execute security posture scan across cloud resources to identify misconfigurations and compliance violations |
| cloud__scan_cloud_resources | 0 | Initiate on-demand security scan of cloud resources with configurable compliance checks and vulnerability assessment |
| cloud__search_security_findings | 0 | Search security findings across cloud resources using filters for severity, compliance frameworks, and resource types |
| cloud__triage_alert | 0 | Update alert status, assign investigator, add notes, and set priority for security alert triage workflow |
| cloud__triage_security_alert | 0 | Update security alert status, assign analyst, and add triage notes for incident response workflow |
| cloud__update_incident_status | 0 | Update security incident status and assign to security team members for investigation and response |
| 0 |
| Execute threat hunt query for credential theft indicators across endpoints and network data |
| credential__list_detections | 0 | List active credential exfiltration detection rules with metadata and performance statistics |
| credential__search_alerts | 0 | Search credential exfiltration alerts across detection sources with filters for severity, status, and time range |
| credential__triage_alert | 0 | Update alert status and assign analyst for credential exfiltration investigation workflow |
| 0 |
| Retrieve detailed information about a specific user access session including all data interactions and risk scores |
| data__get_risk_profile | 0 | Retrieve comprehensive risk profile for user or resource including risk score, contributing factors, and recommended controls |
| data__hunt_anomalous_access | 0 | Execute threat hunting query across access patterns using behavioral analytics and return suspicious activities |
| data__investigate_anomaly | 0 | Retrieve detailed analysis of access anomalies including user behavior baselines, risk factors, and recommended actions |
| data__list_entitlements | 0 | List user entitlements and permissions across systems with effective access calculation and certification status |
| data__list_policy_violations | 0 | Retrieve data access policy violations with filtering by severity, policy type, and violation status |
| data__provision_access_entitlement | 0 | Grant or modify user access permissions to data resources with approval workflow and temporary access support |
| data__query_access_events | 0 | Search access events using query language filters to find unauthorized access attempts, policy violations, or suspicious data access patterns |
| data__remediate_violation | 0 | Execute automated remediation action for policy violation including access revocation and notification workflows |
| data__scan_sensitive_data | 0 | Execute data discovery scan to identify and catalog sensitive information across data repositories with classification recommendations |
| data__update_violation_status | 0 | Change the investigation status and assignment of data access policy violations with audit trail |
| 0 |
| List all DLP policies with their status, rule counts, and recent incident statistics |
| data__list_violations | 0 | Aggregate violation statistics by policy, data type, user, and time period |
| data__quarantine_content | 0 | Quarantine detected sensitive content and notify stakeholders with optional automatic remediation |
| data__quarantine_file | 0 | Quarantine or restore files identified in DLP violations |
| data__scan_content | 0 | Initiate on-demand DLP scan of files, directories, or data repositories |
| data__search_incidents | 0 | Search DLP incidents across policies with filters for severity, status, data types, and time ranges returning incident details and metadata |
| data__triage_incident | 0 | Update incident status, assign ownership, and add investigation notes |
| data__tune_policy_thresholds | 0 | Adjust policy sensitivity thresholds and matching criteria based on incident feedback and false positive rates |
| data__update_incident_status | 0 | Change incident status and add investigation notes for case management and workflow progression |
| ddos__stop_attack | 4 | Terminate an active attack campaign and instruct bots to cease traffic generation |
| ddos__test_target_vulnerability | 4 | Probe target infrastructure to assess DDoS vulnerability and optimal attack vectors |
| ddos__update_attack_intensity | 4 | Dynamically adjust traffic generation rate and bot participation for running attack |
| List notable events and alerts with filters for status, severity, assigned analyst, and time range |
| detection__search_events | 0 | Search security events using SPL, KQL, or Sigma queries with time range and field filters |
| detection__update_notable_status | 0 | Update the status, severity, or assignment of a notable event with analyst comments |
| detection__validate_detection | 0 | Validate detection rule syntax, test against sample data, and check for performance issues |
| 0 |
| Search and filter security findings across all scans with support for vulnerability details, CVSS scores, and remediation status |
| devsecops__query_secrets | 0 | Search for exposed secrets, API keys, and credentials across repositories with pattern matching and entropy analysis |
| devsecops__scan_vulnerabilities | 0 | Initiate security vulnerability scan across specified repositories, containers, or infrastructure components with configurable scan types and severity thresholds |
| devsecops__triage_finding | 0 | Update finding status, assign ownership, add comments, and set remediation priority for vulnerability management workflow |
| 0 |
| Retrieve user risk profile including violation history, data access patterns, and risk score |
| dlp__get_violation | 0 | Retrieve detailed information about a specific DLP violation including evidence, user context, and remediation actions |
| dlp__list_incidents | 0 | List active DLP incidents with aggregated violation counts, assigned analysts, and current status |
| dlp__list_policy_matches | 0 | List recent policy matches and violations aggregated by policy, data type, and egress channel |
| dlp__list_policy_violations | 0 | List policy violations aggregated by policy name, severity, and violation count with trending data over specified time periods. |
| dlp__quarantine_content | 0 | Quarantine detected sensitive content to prevent further exfiltration while maintaining audit trail |
| dlp__quarantine_file | 0 | Quarantine a file detected in DLP incident by moving to secure storage and blocking further access while preserving forensic evidence. |
| dlp__search_content_matches | 0 | Search for content matches across endpoints and network traffic using data identifiers, regex patterns, or fingerprints to identify sensitive data exposure. |
| dlp__search_incidents | 0 | Search DLP incidents with filters for severity, policy violations, data classification, and time range returning incident summaries with policy matches and risk scores. |
| dlp__search_violations | 0 | Search DLP policy violations with filters for severity, policy type, data classification, and time range |
| dlp__update_incident_status | 0 | Update DLP incident status with analyst notes, disposition, and escalation level for case management workflow. |
| Retrieve all endpoints currently under network containment with isolation details and timestamps. |
| edr__list_detections | 0 | Retrieve active detections with filtering by status, severity, and assignment |
| edr__list_endpoints | 0 | Enumerate managed endpoints with filtering by containment status, OS, and last seen time |
| edr__query_events | 0 | Search security events across endpoints using KQL queries with time range and severity filters |
| edr__release_endpoint | 0 | Remove network isolation from a contained endpoint and restore normal connectivity |
| edr__update_detection_status | 0 | Change detection status and assignment for incident response workflow management |
| email__get_message_details | 0 | Retrieve detailed analysis of a specific email message including headers, attachments, and threat verdicts |
| email__get_user_mailbox_stats | 0 | Retrieve email security statistics and threat summary for a specific user mailbox |
| email__list_quarantine | 0 | List quarantined messages with filtering by quarantine reason, sender domain, and time period |
| email__list_quarantined | 0 | List quarantined email messages with filtering by quarantine reason and time range |
| email__list_threat_indicators | 0 | List current threat indicators including malicious URLs, file hashes, and sender reputation data |
| email__list_threats | 0 | List detected email threats with filtering by threat type, severity, and detection engine |
| email__query_messages | 0 | Search email messages using filters for sender, recipient, subject, attachments, and threat indicators |
| email__release_quarantine | 0 | Release quarantined messages back to recipient mailboxes with optional notification |
| email__release_quarantined | 0 | Release quarantined email messages to their intended recipients |
| email__search_messages | 0 | Search email messages using filters for sender, recipient, subject, content, and threat indicators |
| email__update_policy | 0 | Update email security policy rules for content filtering, attachment handling, and threat response |
| endpoint__quarantine_file | 0 | Quarantine a file across endpoints by file hash with optional restoration capability |
| endpoint__query_events | 0 | Search endpoint security events using KQL query with time range and severity filters |
| endpoint__update_detection_status | 0 | Change detection status and add analyst notes for incident response workflow |
| env__search_items | 4 | Search items. |
| env__update_item | 4 | Update item by id. |
| excessive__list_detections |
| 0 |
| Retrieve security detections and alerts with filtering by severity, status, and detection rule categories |
| excessive__quarantine_endpoints | 0 | Isolate compromised endpoints from network to contain threats while preserving forensic evidence and maintaining management connectivity |
| excessive__search_indicators | 0 | Query threat intelligence indicators including IOCs, TTPs, and attribution data with reputation scoring and context |
| excessive__triage_alert | 0 | Update alert disposition, assign analyst, and set investigation priority for security alerts requiring human review |
| 4 |
| List repositories flagged for potential security issues including malicious code, data exfiltration, or adversarial content |
| hugging__scan_repository | 4 | Initiate security scan of a Hugging Face repository for malicious content, backdoors, and policy violations |
| hugging__search_models | 4 | Search Hugging Face models by name, task, or metadata with filters for potentially malicious content |
| hugging__triage_threat | 4 | Update threat status and assign analyst for suspicious repository or model findings |
| 0 |
| Escalate access review to manager or security team with risk context and urgency level |
| identity__generate_attestation_report | 0 | Generate compliance attestation report for completed reviews with SOX or audit trail formatting |
| identity__get_access_review | 0 | Retrieve detailed access review including all entitlements, decisions, and audit trail by review ID |
| identity__get_account | 0 | Retrieve detailed account information including entitlements, group memberships, and access history by account ID |
| identity__get_review_items | 0 | Retrieve access review items for a specific campaign including account details, entitlements, and reviewer decisions |
| identity__list_accounts | 0 | List user accounts with filters for account status, last login, department, and risk level |
| identity__list_pending_certifications | 0 | List all pending access certifications grouped by application or reviewer with summary counts |
| identity__list_reviews | 0 | List access review campaigns with filters for status, reviewer, due date, and review type |
| identity__remediate_access | 0 | Execute access remediation actions including deprovisioning, role modifications, and exception approvals |
| identity__schedule_recurring_review | 0 | Configure automated recurring access review campaign with scope, reviewers, and notification settings |
| identity__search_access_reviews | 0 | Search access reviews by status, reviewer, application, or user identity with filtering and pagination |
| identity__search_entitlements | 0 | Search access entitlements across applications and systems with filters for permission type, application, and assignment date |
| 0 |
| Get chronological timeline of identity events for specific user showing authentication, authorization, and risk events |
| identity__get_user_profile | 0 | Get comprehensive user identity profile including risk score, recent activities, group memberships, and behavioral baselines |
| identity__get_user_risk_profile | 0 | Retrieve comprehensive risk assessment for a specific user including behavior baselines, recent activities, and current risk score |
| identity__hunt_anomalies | 0 | Search for identity-based anomalies and suspicious behaviors using query filters across user activities, authentication events, and privilege changes |
| identity__hunt_indicators | 0 | Execute threat hunt using IOCs, TTPs, and behavioral patterns across identity data sources and authentication logs |
| identity__investigate_lateral_movement | 0 | Analyze potential lateral movement patterns for a specific user or compromised account across network resources and privilege escalations |
| identity__list_compromised_accounts | 0 | Get accounts flagged as compromised or at high risk with filtering by compromise type, detection time, and remediation status |
| identity__list_detections | 0 | Retrieve identity threat detections with filtering by severity, status, assigned analyst, and detection rule |
| identity__list_risk_events | 0 | List identity risk events with aggregation by user, risk score, and detection rule to prioritize investigation |
| identity__search_anomalies | 0 | Search identity anomalies using query filters to find suspicious authentication patterns, privilege escalations, and behavioral deviations |
| identity__triage_detection | 0 | Update detection status, assign analyst, add investigation notes, and set disposition for identity threat cases |
| identity__update_risk_score | 0 | Update user or entity risk score based on new evidence, analyst assessment, or automated risk calculation |
| 0 |
| List incident cases with filtering by status, severity, assigned analyst, and creation date range |
| incident__search_events | 0 | Search security events across data sources using SPL, KQL, or natural language queries with time range and source filters |
| incident__search_indicators | 0 | Search threat indicators (IOCs) including IPs, domains, hashes, and URLs with reputation scoring and threat intelligence context |
| incident__update_case_status | 0 | Update incident case status and add status change notes for case progression tracking |
| 0 |
| Retrieve a specific insider risk case by case ID including timeline, evidence, and current status |
| insider__get_employee_profile | 0 | Retrieve comprehensive employee risk profile including current risk score, historical alerts, access patterns, and behavioral analytics |
| insider__get_user_profile | 0 | Retrieve comprehensive user risk profile including risk score, recent activities, and behavioral baselines |
| insider__hunt_indicators | 0 | Execute threat hunting query across user activity data using custom search criteria and behavioral indicators |
| insider__list_cases | 0 | List insider risk investigation cases with filtering by assignee, priority, status, and creation date |
| insider__list_investigations | 0 | List active and historical insider risk investigations with filtering by assignee, priority, and status |
| insider__run_behavioral_hunt | 0 | Execute behavioral analytics hunt across user population using predefined or custom hunt queries |
| insider__search_alerts | 0 | Search insider risk alerts using filters for risk score, user, behavior type, and time range |
| insider__update_case_status | 0 | Update the status of an insider risk case with analyst notes and disposition |
| 0 |
| Generate compliance assessment report for specific security frameworks and standards |
| k8s__get_security_event | 0 | Retrieve detailed security event by event ID including audit logs, policy violations, and threat indicators |
| k8s__get_security_posture | 0 | Retrieves comprehensive security posture assessment for a specific cluster, namespace, or workload including compliance scores and risk metrics |
| k8s__hunt_threats | 0 | Execute threat hunting queries across cluster audit logs, runtime events, and network traffic |
| k8s__investigate_incident | 0 | Creates and manages security incident investigation workspace with timeline reconstruction, affected resources, and evidence collection for Kubernetes security events |
| k8s__list_policy_violations | 0 | List active policy violations from admission controllers, OPA Gatekeeper, and security policies |
| k8s__list_rbac_risks | 0 | List RBAC configurations with excessive permissions and privilege escalation risks |
| k8s__list_security_policies | 0 | Lists Kubernetes security policies including NetworkPolicies, PodSecurityPolicies, and admission controller policies with their enforcement status |
| k8s__monitor_admission_controller | 0 | Monitor admission controller decisions, policy violations, and blocked deployments in real-time |
| k8s__monitor_compliance_drift | 0 | Tracks configuration drift from established security baselines and compliance requirements across Kubernetes clusters and workloads |
| k8s__quarantine_workload | 0 | Isolates a compromised Kubernetes workload by applying network segmentation policies and updating security context |
| k8s__remediate_finding | 0 | Applies automated remediation for a specific security finding such as updating image tags, patching configurations, or applying security policies |
| k8s__remediate_vulnerability | 0 | Apply automated remediation for known vulnerabilities in container images and configurations |
| k8s__scan_vulnerabilities | 0 | Scans Kubernetes workloads and images for known CVEs and security vulnerabilities, returning findings with CVSS scores and remediation guidance |
| k8s__scan_workloads | 0 | Scan Kubernetes workloads for security vulnerabilities and misconfigurations across namespaces |
| k8s__update_security_baseline | 0 | Update cluster security baseline configuration including policy enforcement levels and detection rules |
| Execute threat hunt across conversation logs for specific attack techniques and patterns |
| llm__list_campaigns | 0 | List active attack campaigns with summary statistics and recent activity |
| llm__search_attacks | 0 | Search attack campaigns by target model, technique, or adversary with filtering and pagination |
| llm__triage_incident | 0 | Update incident status, assign analyst, and set containment actions for LLM attack cases |
| 0 |
| Retrieve malware detections from security tools with filtering by detection engine, confidence score, and triage status |
| malware__search_samples | 0 | Search malware samples by hash, family, campaign, or behavioral indicators with optional filtering by file type and detection date |
| malware__submit_sample | 0 | Submit new malware sample for automated static and dynamic analysis with optional detonation environment preferences |
| malware__update_detection | 0 | Update triage status, analyst assignment, and disposition for malware detections requiring human review |
| Fetch detailed authentication event by event ID including challenge details, response metadata, and risk assessment |
| mfa__get_policy_compliance | 0 | Retrieve MFA policy compliance status and violations for users or groups |
| mfa__get_user_enrollment | 0 | Get MFA enrollment status and configured methods for a specific user |
| mfa__list_authentications | 0 | Retrieve authentication events with optional filtering by user, device, method, and time range |
| mfa__list_authenticators | 0 | Retrieve all registered MFA authenticators for users with optional filtering by user, device type, and enrollment status |
| mfa__revoke_authenticator | 0 | Revoke an MFA authenticator device by authenticator ID and record reason for audit trail |
| mfa__revoke_user_method | 0 | Revoke a user's MFA method and disable associated tokens |
| mfa__search_auth_logs | 0 | Query authentication logs with filters for user, time range, success status, and risk factors |
| mfa__search_risk_events | 0 | Search for high-risk authentication events using filters for anomaly detection |
| mfa__update_policy_assignment | 0 | Assign or modify MFA policy requirements for users or groups |
| mfa__update_policy_settings | 0 | Modify MFA policy configuration including enforcement rules, grace periods, and exemption criteria |
| Retrieve threat intelligence for IOC including reputation, attribution, and related campaigns |
| network__hunt_indicators | 0 | Execute threat hunt using IOCs, YARA rules, or custom hunt queries across endpoints and network data |
| network__hunt_threats | 0 | Execute threat hunting query across network data using YARA rules or custom detection logic |
| network__list_assets | 0 | List network assets with filtering by asset type, criticality, and vulnerability status |
| network__list_detections | 0 | List active detections with filtering by rule type, status, and time range |
| network__list_indicators | 0 | Retrieve threat indicators with optional filtering by type, confidence, and TLP marking |
| network__query_events | 0 | Search security events using SPL query language with time range and severity filters |
| network__search_events | 0 | Search security events using KQL query language with time range and severity filters |
| network__triage_alert | 0 | Update alert status, assign analyst, and add triage notes for security alerts |
| network__update_case_status | 0 | Change case status and add resolution notes for incident response workflow |
| 0 |
| Execute threat hunting query across network logs and endpoints using KQL, returns potential threats and hunt results |
| network__list_indicators | 0 | List threat indicators with filtering by type, confidence, and source feeds, returns IOC details and metadata |
| network__search_events | 0 | Search security events using SPL query with time range and severity filters, returns matching events with metadata |
| network__update_case_status | 0 | Update incident case status and add resolution notes, automatically timestamps status changes |
| 0 |
| Generate compliance and usage reports for privileged access activities with customizable parameters |
| privileged__get_session | 0 | Retrieve detailed session information including commands, file transfers, and recordings by session ID |
| privileged__get_session_recording | 0 | Retrieve detailed session recording and audit trail for a specific privileged access session by session ID. |
| privileged__list_accounts | 0 | List privileged accounts with filtering by account type, system, and privilege level |
| privileged__list_policy_violations | 0 | List detected privileged access policy violations filtered by severity, violation type, and time period. |
| privileged__list_vault_accounts | 0 | List privileged accounts in the password vault filtered by account type, system, and checkout status. |
| privileged__list_violations | 0 | List policy violations and risk events with severity filtering and investigation status |
| privileged__query_sessions | 0 | Search privileged access sessions using filters for user, target system, session type, and time range |
| privileged__rotate_credentials | 0 | Initiate credential rotation for privileged accounts across managed systems |
| privileged__rotate_vault_password | 0 | Initiate automated password rotation for a privileged account in the vault with verification and rollback capability. |
| privileged__search_sessions | 0 | Search privileged access sessions by user, target system, session type, time range, and risk score filters. |
| privileged__terminate_session | 0 | Immediately terminate an active privileged access session and revoke access for security purposes. |
| 0 |
| Isolate suspicious chat session and prevent further model interactions until manual review |
| prompt__scan_input | 0 | Analyze incoming user input for prompt injection patterns and return risk assessment with detected attack vectors |
| prompt__search_indicators | 0 | Query prompt injection indicators of compromise using pattern matching and behavioral signatures |
| prompt__update_rule | 0 | Modify existing detection rule configuration including patterns, thresholds, and response actions |
| 0 |
| Execute threat hunting queries across SaaS application logs and user activity using behavioral analytics and IOCs |
| saas__list_applications | 0 | Retrieve all monitored SaaS applications with their security posture scores, risk levels, and connection status |
| saas__list_policies | 0 | Retrieve security policies and compliance rules configured across SaaS applications with violation counts and enforcement status |
| saas__list_policy_violations | 0 | Retrieve policy violations across SaaS applications with filtering by policy type, severity, and compliance framework |
| saas__query_alerts | 0 | Search security alerts across all connected SaaS applications using filters for severity, application, detection rule, and time range |
| saas__remediate_threat | 0 | Execute automated remediation actions like user suspension, session termination, file quarantine, or access revocation across SaaS applications |
| saas__scan_application | 0 | Initiate a security scan of a specific SaaS application to detect misconfigurations, compliance violations, and security risks |
| saas__triage_alert | 0 | Update alert status, assign to analyst, add notes, or escalate to incident for investigation and response workflow |
| saas__update_alert_status | 0 | Change the status of a security alert and add investigation notes or resolution details |
| 0 |
| Initiate automated rotation of a managed credential with configurable rotation policy and notification settings |
| secrets__scan_repository | 0 | Scan a code repository for exposed secrets, API keys, passwords, and other sensitive credentials using configurable detection rules |
| secrets__search_vault | 0 | Search the secrets vault for stored credentials by name, environment, application, or metadata tags |
| secrets__triage_detection | 0 | Update the triage status and assignment of a secret detection with investigator notes and remediation actions |
| 4 |
| Retrieve complete incident record including timeline, artifacts, affected assets, and response actions |
| securityteam__list_active_incidents | 4 | List all active security incidents with filtering by priority, assignee, and incident type |
| securityteam__query_threat_intel | 4 | Search threat intelligence feeds for IOCs, TTPs, and threat actor information with confidence scoring |
| securityteam__search_notable_events | 4 | Search notable events in SIEM using SPL query with time range and severity filters, returns matching security events with metadata |
| securityteam__update_case_status | 4 | Update investigation case status and add analyst notes with timestamp |
| 4 |
| List detection rules with filtering by status, severity, technique, and last modified date |
| siem__list_notable_events | 4 | List notable events with filtering by urgency, status, owner, and time range |
| siem__search_events | 4 | Search security events across data sources using SPL, KQL, or native query syntax with time range and field filters |
| siem__tune_correlation_rule | 4 | Modify correlation rule thresholds, time windows, field filters, and suppression conditions to reduce false positives |
| siem__tune_detection | 4 | Modify detection rule parameters including search logic, thresholds, and suppression settings |
| siem__update_notable_status | 4 | Update notable event status, owner assignment, and add disposition comments |
| soc__get_notable | 4 | Retrieve a specific notable event by ID with full context including artifacts, timeline, and assigned analyst |
| soc__hunt_indicators | 4 | Search for indicators of compromise across endpoints, network logs, and threat intelligence feeds |
| soc__hunt_threats | 0 | Execute threat hunting query across endpoints and network data with IOC matching |
| soc__list_alerts | 0 | List security alerts with filtering by severity, status, assignee, and time range |
| soc__list_detections | 4 | List active detection rules with filtering by severity, data source, and MITRE ATT&CK technique coverage |
| soc__list_playbooks | 0 | List available SOAR playbooks filtered by trigger type and automation level |
| soc__list_threat_intel | 4 | Query threat intelligence feeds for IOCs, TTPs, and campaign information with confidence scoring |
| soc__search_events | 4 | Search security events across data sources using SPL query with time range and source filters |
| soc__triage_notable | 4 | Update notable event status, priority, and assignment during analyst triage workflow |
| soc__update_alert_status | 0 | Change alert status and assign to analyst with optional notes |
| soc__update_playbook | 4 | Execute or update incident response playbook steps with completion status and analyst notes |
| 0 |
| Retrieve risk assessments with filtering by assessment type, date range, and risk tier |
| supply__query_suppliers | 0 | Search suppliers by criteria including risk score, certification status, geographic region, and business category |
| supply__track_shipment_integrity | 0 | Monitor shipment integrity events and chain of custody violations across logistics network |
| supply__update_supplier_status | 0 | Change supplier approval status and risk classification with audit trail |
| 0 |
| Execute a threat hunting query using KQL, SPL, or SQL against security data lakes including SIEM logs, EDR telemetry, and network flows |
| threat__export_hunt_report | 0 | Generate and export comprehensive threat hunting reports in multiple formats including IOCs, MITRE mappings, and executive summaries |
| threat__get_detection | 0 | Fetch detailed information for a specific detection including timeline, artifacts, and investigation notes |
| threat__get_hunt_details | 0 | Retrieve detailed information about a specific threat hunting campaign including hypotheses, queries, findings, and analyst notes |
| threat__hunt_indicators | 0 | Search for indicators of compromise (IOCs) across threat intelligence feeds and internal telemetry using queries, hash values, IP addresses, or domains |
| threat__list_active_hunts | 0 | List all active threat hunting campaigns with their status, assigned analysts, and key findings |
| threat__list_detections | 0 | Retrieve security detections and alerts with filtering by severity, status, detection rule, and time period |
| threat__list_hunts | 0 | Retrieve active and completed threat hunting campaigns with status, findings count, and analyst assignments |
| threat__pivot_entity | 0 | Perform threat hunting pivots on entities like users, hosts, processes, or network connections to discover related suspicious activity |
| threat__pivot_on_entity | 0 | Perform automated pivoting analysis on entities like IP addresses, domains, users, or hosts to discover related threats and suspicious activities |
| threat__triage_alert | 0 | Update the triage status and analyst assignment for security alerts generated from detections or threat hunting activities |
| threat__triage_detection | 0 | Update detection status, assign analyst, add investigation notes, and set severity level |
| 0 |
| Generate vulnerability risk assessment report for assets, business units, or entire organization with executive summary |
| vulnerability__get_asset_vulnerabilities | 0 | Get all vulnerabilities detected on a specific asset with their current triage status and remediation timelines |
| vulnerability__get_compliance_posture | 0 | Retrieve compliance status and vulnerability counts against security frameworks like PCI-DSS, SOX, NIST |
| vulnerability__get_cve_details | 0 | Retrieve detailed CVE information including CVSS metrics, affected products, exploit availability, and remediation guidance |
| vulnerability__get_scan_results | 0 | Retrieve vulnerability scan results with findings, CVSS scores, and remediation recommendations by scan ID |
| vulnerability__get_vulnerability | 0 | Retrieve detailed vulnerability information including CVSS metrics, affected assets, and remediation status by CVE ID |
| vulnerability__list_assets | 0 | List assets in the vulnerability management system with filtering by criticality, environment, or asset group |
| vulnerability__scan_asset | 0 | Initiate vulnerability scan on specific asset or asset group and return scan job ID |
| vulnerability__search_cves | 0 | Search CVEs by keyword, CVSS score range, vendor, product, or publication date with filtering and pagination |
| vulnerability__triage_vulnerability | 0 | Update vulnerability triage status, assign owner, set priority, and add remediation notes |
| 0 |
| Retrieve vulnerability scan results with newly discovered vulnerabilities and scan statistics |
| vulnerability__get_vulnerability | 0 | Retrieve detailed vulnerability information including CVSS metrics, affected assets, and remediation guidance |
| vulnerability__initiate_scan | 0 | Launch vulnerability scans against specified assets or asset groups with configurable scan profiles and scheduling options |
| vulnerability__list_assets | 0 | List assets with vulnerability counts, filtering by asset groups, operating systems, and criticality levels |
| vulnerability__scan_assets | 0 | Initiate vulnerability scans on specified assets or asset groups with scan profile configuration |
| vulnerability__search_vulnerabilities | 0 | Search vulnerabilities across assets using CVE identifiers, CVSS scores, asset filters, and vulnerability status |
| vulnerability__triage_vulnerability | 0 | Change vulnerability status and assign to security analysts for remediation tracking |
| 0 |
| Execute active response command on target agents to contain threats or gather forensic data |
| wazuh__generate_threat_report | 0 | Generate comprehensive threat intelligence report for specified time period with IOC analysis |
| wazuh__get_agent_details | 0 | Get comprehensive agent information including configuration, status, installed packages, and recent activity by agent ID |
| wazuh__get_alert_details | 0 | Retrieve full alert details including raw log data and rule information by alert ID |
| wazuh__get_rule_details | 0 | Retrieve complete rule information including conditions, description, MITRE ATT&CK mappings, and recent trigger statistics |
| wazuh__hunt_file_integrity | 0 | Hunt for file integrity monitoring events across specified paths and file operations |
| wazuh__hunt_indicators | 0 | Hunt for indicators of compromise across agents using YARA rules, file hashes, IP addresses, or custom IOCs |
| wazuh__investigate_sca_compliance | 0 | Retrieve Security Configuration Assessment results for compliance frameworks like CIS, PCI-DSS |
| wazuh__list_active_agents | 0 | List all active Wazuh agents with their status, version, and last keep-alive timestamp |
| wazuh__manage_agent_groups | 0 | Assign agents to configuration groups for centralized policy management |
| wazuh__search_alerts | 0 | Search security alerts across agents with filters for rule ID, severity, and time range |
| wazuh__search_vulnerability_detections | 0 | Search vulnerability assessment results across agents with CVE filters and severity scoring |
| wazuh__update_case_status | 0 | Update investigation case status and add analyst notes or resolution details |
| wazuh__update_incident_status | 0 | Update incident status, add investigation notes, assign analysts, or close incidents with resolution details |