{"ok":true,"site":{"host":"cyberguard-frontend-iota.vercel.app","url":"https://cyberguard-frontend-iota.vercel.app/","type":"live","desc":"CyberGuard","tools":[{"name":"get_security_summary","kind":"answer","impl":"imperative","description":"Returns high-level summary counts of anomalies, active alerts, and flagged entities.","inputSchema":{"type":"object","properties":{},"required":[],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"get_suspicious_users","kind":"answer","impl":"imperative","description":"Returns users ranked by anomaly detection score from the DS engine. Optional `limit` caps the result count (default 5).","inputSchema":{"type":"object","properties":{"limit":{"type":"integer","minimum":1,"maximum":100,"default":5,"description":"Maximum number of ranked users to return."}},"required":[],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"investigate_user","kind":"answer","impl":"imperative","description":"Retrieves detailed authentication telemetry, failed attempts, and originating IPs for a specific user.","inputSchema":{"type":"object","properties":{"user_id":{"type":"string","minLength":2,"maxLength":64,"pattern":"^[A-Za-z0-9._:-]+$","description":"Target user identifier, e.g. \"USR-402\"."}},"required":["user_id"],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"get_user_risk_score","kind":"answer","impl":"imperative","description":"Calculates the normalized 0-100 risk score and top contributing risk factors for a user.","inputSchema":{"type":"object","properties":{"user_id":{"type":"string","minLength":2,"maxLength":64,"pattern":"^[A-Za-z0-9._:-]+$","description":"Target user identifier, e.g. \"USR-402\"."}},"required":["user_id"],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"detect_attack_pattern","kind":"act","impl":"imperative","description":"Runs the user's behavioral signals through the attack classification model (returns classified pattern, confidence, and MITRE technique id).","inputSchema":{"type":"object","properties":{"user_id":{"type":"string","minLength":2,"maxLength":64,"pattern":"^[A-Za-z0-9._:-]+$","description":"Target user identifier, e.g. \"USR-402\"."}},"required":["user_id"],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"generate_incident_report","kind":"act","impl":"imperative","description":"Generates an official SOC incident id and records containment recommendations. Analytical only — does not execute remediation.","inputSchema":{"type":"object","properties":{"user_id":{"type":"string","minLength":2,"maxLength":64,"pattern":"^[A-Za-z0-9._:-]+$","description":"Target user identifier, e.g. \"USR-402\"."},"threat_type":{"type":"string","enum":["Normal","Brute Force","Credential Stuffing","Account Takeover","Account Takeover (ATO)","Password Spraying","Session Hijacking","Anomalous Authentication","Suspicious Authentication Activity"],"description":"Threat classification for the incident."},"severity":{"type":"string","enum":["LOW","MEDIUM","HIGH","CRITICAL"],"description":"Assessed severity level."},"recommendations":{"type":"array","minItems":1,"maxItems":25,"items":{"type":"string","minLength":3,"maxLength":500},"description":"Non-destructive, human-authorized containment / hardening steps."}},"required":["user_id","threat_type","severity","recommendations"],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"get_active_incidents","kind":"answer","impl":"imperative","description":"Returns incidents created by CyberGuard login security analysis.","inputSchema":{"type":"object","properties":{},"required":[],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"get_incident_details","kind":"answer","impl":"imperative","description":"Returns evidence and containment state for an incident.","inputSchema":{"type":"object","properties":{"incident_id":{"type":"string","minLength":2,"maxLength":128}},"required":["incident_id"],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"},{"name":"get_access_control_status","kind":"answer","impl":"imperative","description":"Returns the application-level access state for a user.","inputSchema":{"type":"object","properties":{"user_id":{"type":"string","minLength":2,"maxLength":64,"pattern":"^[A-Za-z0-9._:-]+$","description":"Target user identifier, e.g. \"USR-402\"."}},"required":["user_id"],"additionalProperties":false},"hasHandler":true,"hasExecute":true,"__source":"spec","executable":true,"handlerField":"execute"}],"category":"Developer Tools","apiSurface":"spec","toolCount":9}}