Implementation
gradeNot graded
gradeNot graded
get_security_summaryAnswer
Returns high-level summary counts of anomalies, active alerts, and flagged entities.
View tool JSON
{
"name": "get_security_summary",
"kind": "answer",
"impl": "imperative",
"description": "Returns high-level summary counts of anomalies, active alerts, and flagged entities.",
"inputSchema": {
"type": "object",
"properties": {},
"required": [],
"additionalProperties": false
}
}get_suspicious_usersAnswer
Returns users ranked by anomaly detection score from the DS engine. Optional `limit` caps the result count (default 5).
View tool JSON
{
"name": "get_suspicious_users",
"kind": "answer",
"impl": "imperative",
"description": "Returns users ranked by anomaly detection score from the DS engine. Optional `limit` caps the result count (default 5).",
"inputSchema": {
"type": "object",
"properties": {
"limit": {
"type": "integer",
"minimum": 1,
"maximum": 100,
"default": 5,
"description": "Maximum number of ranked users to return."
}
},
"required": [],
"additionalProperties": false
}
}investigate_userAnswer
Retrieves detailed authentication telemetry, failed attempts, and originating IPs for a specific user.
View tool JSON
{
"name": "investigate_user",
"kind": "answer",
"impl": "imperative",
"description": "Retrieves detailed authentication telemetry, failed attempts, and originating IPs for a specific user.",
"inputSchema": {
"type": "object",
"properties": {
"user_id": {
"type": "string",
"minLength": 2,
"maxLength": 64,
"pattern": "^[A-Za-z0-9._:-]+$",
"description": "Target user identifier, e.g. \"USR-402\"."
}
},
"required": [
"user_id"
],
"additionalProperties": false
}
}get_user_risk_scoreAnswer
Calculates the normalized 0-100 risk score and top contributing risk factors for a user.
View tool JSON
{
"name": "get_user_risk_score",
"kind": "answer",
"impl": "imperative",
"description": "Calculates the normalized 0-100 risk score and top contributing risk factors for a user.",
"inputSchema": {
"type": "object",
"properties": {
"user_id": {
"type": "string",
"minLength": 2,
"maxLength": 64,
"pattern": "^[A-Za-z0-9._:-]+$",
"description": "Target user identifier, e.g. \"USR-402\"."
}
},
"required": [
"user_id"
],
"additionalProperties": false
}
}detect_attack_patternAction
Runs the user's behavioral signals through the attack classification model (returns classified pattern, confidence, and MITRE technique id).
View tool JSON
{
"name": "detect_attack_pattern",
"kind": "act",
"impl": "imperative",
"description": "Runs the user's behavioral signals through the attack classification model (returns classified pattern, confidence, and MITRE technique id).",
"inputSchema": {
"type": "object",
"properties": {
"user_id": {
"type": "string",
"minLength": 2,
"maxLength": 64,
"pattern": "^[A-Za-z0-9._:-]+$",
"description": "Target user identifier, e.g. \"USR-402\"."
}
},
"required": [
"user_id"
],
"additionalProperties": false
}
}generate_incident_reportAction
Generates an official SOC incident id and records containment recommendations. Analytical only — does not execute remediation.
View tool JSON
{
"name": "generate_incident_report",
"kind": "act",
"impl": "imperative",
"description": "Generates an official SOC incident id and records containment recommendations. Analytical only — does not execute remediation.",
"inputSchema": {
"type": "object",
"properties": {
"user_id": {
"type": "string",
"minLength": 2,
"maxLength": 64,
"pattern": "^[A-Za-z0-9._:-]+$",
"description": "Target user identifier, e.g. \"USR-402\"."
},
"threat_type": {
"type": "string",
"enum": [
"Normal",
"Brute Force",
"Credential Stuffing",
"Account Takeover",
"Account Takeover (ATO)",
"Password Spraying",
"Session Hijacking",
"Anomalous Authentication",
"Suspicious Authentication Activity"
],
"description": "Threat classification for the incident."
},
"severity": {
"type": "string",
"enum": [
"LOW",
"MEDIUM",
"HIGH",
"CRITICAL"
],
"description": "Assessed severity level."
},
"recommendations": {
"type": "array",
"minItems": 1,
"maxItems": 25,
"items": {
"type": "string",
"minLength": 3,
"maxLength": 500
},
"description": "Non-destructive, human-authorized containment / hardening steps."
}
},
"required": [
"user_id",
"threat_type",
"severity",
"recommendations"
],
"additionalProperties": false
}
}get_active_incidentsAnswer
Returns incidents created by CyberGuard login security analysis.
View tool JSON
{
"name": "get_active_incidents",
"kind": "answer",
"impl": "imperative",
"description": "Returns incidents created by CyberGuard login security analysis.",
"inputSchema": {
"type": "object",
"properties": {},
"required": [],
"additionalProperties": false
}
}get_incident_detailsAnswer
Returns evidence and containment state for an incident.
View tool JSON
{
"name": "get_incident_details",
"kind": "answer",
"impl": "imperative",
"description": "Returns evidence and containment state for an incident.",
"inputSchema": {
"type": "object",
"properties": {
"incident_id": {
"type": "string",
"minLength": 2,
"maxLength": 128
}
},
"required": [
"incident_id"
],
"additionalProperties": false
}
}get_access_control_statusAnswer
Returns the application-level access state for a user.
View tool JSON
{
"name": "get_access_control_status",
"kind": "answer",
"impl": "imperative",
"description": "Returns the application-level access state for a user.",
"inputSchema": {
"type": "object",
"properties": {
"user_id": {
"type": "string",
"minLength": 2,
"maxLength": 64,
"pattern": "^[A-Za-z0-9._:-]+$",
"description": "Target user identifier, e.g. \"USR-402\"."
}
},
"required": [
"user_id"
],
"additionalProperties": false
}
}