Cotool is an AI security operations platform. These tools work with the user's Cotool agents, skills, alerts, detections, logs, and integrations, acting as the signed-in user with their Cotool permissions. Most results include a url; share it so the user can open the item in Cotool.
Secrets: never ask the user to type or paste an API key, password, token, or private key into the chat, and never pass one to a tool. When an integration needs a secret, configure_integration returns a link; send it to the user so they enter the secret in Cotool. If a secret ever appears in the conversation, tell the user it should be treated as exposed and rotated.
Use search_docs for questions about how Cotool works. Find agents, agent runs, alerts, and detections with their search_ tools, and integrations with list_integrations.
When the user asks how to get started or what to do next in Cotool, call get_setup_status and work from its brief.
To upload a skill folder from disk with create_skill or update_skill:
- Send every text file in the folder verbatim in files, with its path relative to the folder: SKILL.md, references/..., scripts/..., assets/.... Read each file and copy its contents exactly; don't summarize or rewrite them.
- SKILL.md's frontmatter sets the name, description, and allowed-tools (Cotool integration types the skill needs). Its body becomes the instructions.
- Leave out binary files, such as images and archives, and build output such as node_modules.
- Keep one call under about 800 KB of file content. For a bigger skill, create it with SKILL.md and some files, then add the rest with update_skill.
- To pull a skill down to edit locally, call get_skill and write each file to its path.
To connect an integration, call get_integration_setup and follow the `wizard` it returns.
Discoverability
0/6 passed0 of 6 passed0/100
Client listings and public setup information.
mcp.json or server-card.json
Either mcp.json or an MCP Server Card declaring this endpoint passes.
No matching mcp.json manifest or MCP Server Card was found at the checked URLs.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description85/100
Search Cotool's documentation. Use it to answer how-to questions about Cotool and to find where something is set up. Each result links to the docs page.
The description explains the capability, when to use it, and what to expect.
Inputs0/100
0 of 2 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
query
Not provided
Missing description. Explain what this value means and how to supply it.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description84/100
Search the organization's Cotool agents, most recently updated first; all of them when no filter is given. Use get_agent for an agent's full configuration and triggers.
The description explains the capability, when to use it, and what to expect.
Inputs45/100
3 of 5 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
query
Words that must all appear in the name, description, or tags
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
tag
Only agents with this tag
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
agentType
Type of agent: response (standard agent) or detection (security detection agent)
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description86/100
List the models the organization's agents can run on, with the alias to pass as modelAlias to create_agent or update_agent. "auto:chat:default" lets Cotool pick, and "latest-" aliases such as "anthropic:chat:latest-opus" follow the newest model of their class.
The description explains the capability, when to use it, and what to expect.
Inputs99/100
Input documentation gives an agent enough context to populate the arguments.
includeDeprecated
Also list models that are being retired, such as one an agent still uses
The title clearly communicates the tool’s action and subject. Keep it concise.
Description73/100
Create a Cotool agent. Agents run in Cotool with the integrations connected there; list them with list_integrations. Pass template to start from a Cotool template, which fills in the description, system prompt, tools, and model; anything else you pass overrides it. Without a template, description and systemPrompt are required.
The description explains the capability, when to use it, and what to expect.
Inputs68/100
11 of 14 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
template
Cotool template to start from. "Slack Security Assistant" is a read-only assistant for answering security questions in Slack
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
name
Name of the agent; defaults to the template's name
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
description
What the agent does
Explain the meaning of this value, not just its name.
systemPrompt
Instructions that define the agent's behavior
Clear enough to supply this argument.
toolNames
Integration actions the agent may call, such as "okta_listUsers". Get action names from list_integrations with includeActions.
Clear enough to supply this argument.
toolSelectionMode
Tool selection behavior: manual uses the stored tool and CLI lists, all_read_only resolves all non-mutating tools at runtime, all_read_only_plus_selected resolves all non-mutating tools at runtime plus the stored tool and CLI lists
Clear enough to supply this argument.
cliNames
CLI integrations the agent may use in its sandbox, such as "aws"
Clear enough to supply this argument.
planningMode
Not provided
Missing description. Explain what this value means and how to supply it.
persistentWorkspaceEnabled
Not provided
Missing description. Explain what this value means and how to supply it.
tags
Not provided
Missing description. Explain what this value means and how to supply it.
skills › items › skillId
Unique identifier of the skill to attach
Clarify units, where to obtain this value, or conventions not already expressed in the schema.
skills › items › skillVersionId
Optional specific version to pin for this agent binding
Clear enough to supply this argument.
acceptanceCriteria
Checks every run of the agent is evaluated against
Clear enough to supply this argument.
modelAlias
Model alias; leave it out to use the template's model or "auto:chat:default", unless the user asks for a specific model
The title clearly communicates the tool’s action and subject. Keep it concise.
Description74/100
Change an agent. Only the fields you pass change; list fields such as toolNames replace the current list. Each update saves a new version of the agent that can be restored in Cotool.
Explain mutations, irreversible effects, or prerequisites that matter before calling this tool.
Inputs60/100
10 of 15 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
agentId
ID of the agent
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
name
Not provided
Missing description. Explain what this value means and how to supply it.
description
What the agent does
Clear enough to supply this argument.
systemPrompt
Instructions that define the agent's behavior
Clear enough to supply this argument.
toolNames
Integration actions the agent may call, such as "okta_listUsers". Get action names from list_integrations with includeActions.
Clear enough to supply this argument.
toolSelectionMode
Tool selection behavior: manual uses the stored tool and CLI lists, all_read_only resolves all non-mutating tools at runtime, all_read_only_plus_selected resolves all non-mutating tools at runtime plus the stored tool and CLI lists
Clear enough to supply this argument.
cliNames
CLI integrations the agent may use in its sandbox, such as "aws"
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
modelAlias
Not provided
Missing description. Explain what this value means and how to supply it.
planningMode
Not provided
Missing description. Explain what this value means and how to supply it.
persistentWorkspaceEnabled
Not provided
Missing description. Explain what this value means and how to supply it.
tags
Not provided
Missing description. Explain what this value means and how to supply it.
skills › items › skillId
Unique identifier of the skill to attach
Explain what happens when this optional value is omitted.
skills › items › skillVersionId
Optional specific version to pin for this agent binding
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
acceptanceCriteria
Checks every run of the agent is evaluated against
The title clearly communicates the tool’s action and subject. Keep it concise.
Description75/100
Start an agent run in Cotool. The inputs are sent to the agent as its first message. Runs take from seconds to many minutes; check on them with get_agent_run.
Describe the returned information so the agent knows whether it will answer the request.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
agentId
ID of the agent
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
inputs
At least one value, keyed by name, for example {"message": "Investigate alert 123"}
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description96/100
Send a follow-up message to an existing agent run, as if typed in the run's chat. The agent answers with the run's full context. To ask the agent that triaged an alert, pass the alert's assignedAgentId and triageRunId from get_alert. Returns as soon as the message is queued; a busy run answers once its current turn ends. Keep working on other things and check get_agent_run now and then until status is done; its result is the reply.
The description explains the capability, when to use it, and what to expect.
Inputs88/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
agentId
ID of the agent
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
runId
Run ID from run_agent, search_agent_runs, or an alert's triageRunId
Clear enough to supply this argument.
message
Markdown
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
clientMessageId
Your id for this message, so a retried call is not sent twice
{
"name": "send_agent_message",
"title": "Send agent message",
"description": "Send a follow-up message to an existing agent run, as if typed in the run's chat. The agent answers with the run's full context. To ask the agent that triaged an alert, pass the alert's assignedAgentId and triageRunId from get_alert. Returns as soon as the message is queued; a busy run answers once its current turn ends. Keep working on other things and check get_agent_run now and then until status is done; its result is the reply.",
"inputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"agentId",
"runId",
"message"
],
"properties": {
"runId": {
"type": "string",
"format": "uuid",
"description": "Run ID from run_agent, search_agent_runs, or an alert's triageRunId"
},
"agentId": {
"type": "string",
"format": "uuid",
"description": "ID of the agent"
},
"message": {
"type": "string",
"maxLength": 20000,
"minLength": 1,
"description": "Markdown"
},
"clientMessageId": {
"type": "string",
"format": "uuid",
"description": "Your id for this message, so a retried call is not sent twice"
}
},
"additionalProperties": false
},
"outputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"runId",
"messageId",
"status",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Link to open this in Cotool"
},
"runId": {
"type": "string"
},
"status": {
"type": "string",
"const": "queued"
},
"messageId": {
"type": "string"
}
},
"additionalProperties": false
},
"annotations": {
"title": "Send agent message",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": false
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description86/100
Search past agent runs, newest first: what ran, what started it, and whether it hit a problem. Runs of Cotool's built-in agents appear only when agentId names one. Use get_agent_run for a run's result.
The description explains the capability, when to use it, and what to expect.
Inputs78/100
8 of 9 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
agentId
Only runs of this agent
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
query
Text in the run title, linked alert, agent name, or run ID
Clear enough to supply this argument.
triggerSources
Only runs started this way, such as manual, api, slack, cron, webhook, or jira
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
toolName
Only runs that used this integration action
Clear enough to supply this argument.
since
Only runs created at or after this ISO 8601 time
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
until
Only runs created before this ISO 8601 time
Clear enough to supply this argument.
needsAttention
Only runs that hit a blocking problem (such as a broken integration) or failed their acceptance criteria
Clear enough to supply this argument.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
page
0-based page of limit runs
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description83/100
Get an agent run's status, and its final result once it is done. Set includeMessages to page through the run's conversation, oldest first: messages to the agent, its replies, and its tool calls with their output. The latest page starts at totalMessages - messagesLimit.
Describe the returned information so the agent knows whether it will answer the request.
Inputs50/100
3 of 5 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
agentId
ID of the agent
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
runId
Run ID from run_agent, search_agent_runs, or an alert's triageRunId
Clear enough to supply this argument.
includeMessages
Not provided
Missing description. Explain what this value means and how to supply it.
messagesOffset
Messages to skip, counting from the oldest
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
messagesLimit
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description76/100
List the skills agents can use: the organization's skills, your private skills, and the skills built into each connected integration. Use get_skill for a skill's files.
Describe the returned information so the agent knows whether it will answer the request.
Inputs38/100
2 of 4 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
query
Words that must all appear in the name or description
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
includeBuiltIn
Include each connected integration's built-in skill
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description73/100
Create a skill from its files, for example a skill folder on disk: SKILL.md plus any references/, scripts/, and assets/ files. Agents use organization skills once they are attached in create_agent or update_agent.
The description explains the capability, when to use it, and what to expect.
Inputs79/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
files › items › path
Path relative to the skill folder, with forward slashes: SKILL.md, references/guide.md, scripts/check.py, assets/template.json
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
files › items › content
The file's full text, exactly as on disk
Clear enough to supply this argument.
name
Overrides SKILL.md's name. Lowercase letters, numbers, and hyphens.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
description
Overrides SKILL.md's description
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
requiredTools
Integration types the skill needs, e.g. okta. Defaults to SKILL.md's allowed-tools.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
scope
organization: shared, and agents can use it. private: only you, in your own chats.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description81/100
Change a skill. Files are added or replaced by path, and other files stay unless listed in removeFiles or replaceAllFiles is true. Sending SKILL.md updates the instructions, description, name, and allowed-tools from it. Each change makes a new version, which agents pick up unless they pin an older one.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
7 of 8 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
skillId
Skill ID from list_skills or create_skill
Clear enough to supply this argument.
files › items › path
Path relative to the skill folder, with forward slashes: SKILL.md, references/guide.md, scripts/check.py, assets/template.json
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
files › items › content
The file's full text, exactly as on disk
Clear enough to supply this argument.
removeFiles
Paths of files to delete, e.g. references/old.md
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
replaceAllFiles
Make files the complete set, deleting every other file. Use when syncing a whole local folder in one call.
Clear enough to supply this argument.
name
New name. Lowercase letters, numbers, and hyphens.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
description
Not provided
Missing description. Explain what this value means and how to supply it.
requiredTools
Integration types the skill needs, e.g. okta. Defaults to SKILL.md's allowed-tools.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description86/100
Give an existing agent something that starts it: Slack mentions, a schedule, or events from an external system. slack needs slackChannels and answers @Cotool mentions there; cron needs a schedule; the other sources receive webhooks and return steps for the user, whose secret is copied in Cotool, never here. To send an external system's alerts into Cotool's alert queue, use the organization's alert response agent with eventMode alert_source. hackerone and bugcrowd need a secret from the vendor, so they return status finish_in_cotool with a link instead. Confirm with the user first.
Describe the returned information so the agent knows whether it will answer the request.
Inputs57/100
5 of 7 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
agentId
ID of the agent
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
source
What starts the agent. slack answers @Cotool mentions in slackChannels; cron runs on schedule; webhook is for any system that can POST JSON
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
name
Not provided
Missing description. Explain what this value means and how to supply it.
description
Not provided
Missing description. Explain what this value means and how to supply it.
slackChannels
Slack triggers: channel names such as #security, or channel IDs. The Cotool app must already be in each channel
Clear enough to supply this argument.
schedule
Cron triggers: a cron expression such as "0 9 * * 1-5"
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
eventMode
Defaults to alert_source for alert sources such as zscaler and darktrace, direct otherwise
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description85/100
Change one trigger on an existing agent, such as the Slack channels it answers in, its schedule, its name, whether it's on, whether its events become Cotool alerts first, or which Slack destinations each new alert is posted to. Pass only the settings to change; the rest are kept. slackChannels replaces the current list. To stop a trigger, turn it off; triggers can only be deleted in Cotool. Confirm changes with the user first.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
7 of 9 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
agentId
ID of the agent
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
triggerId
ID of the trigger, from get_agent's triggers
Clear enough to supply this argument.
name
Not provided
Missing description. Explain what this value means and how to supply it.
description
Not provided
Missing description. Explain what this value means and how to supply it.
slackChannels
Slack triggers only: channel names such as #security, or IDs. Replaces the channels it answers in
Clear enough to supply this argument.
schedule
Cron triggers only: a cron expression such as "0 9 * * 1-5"
Clear enough to supply this argument.
enabled
Turn the trigger on or off
Clear enough to supply this argument.
eventMode
direct runs the agent on each event; alert_source turns each event into a Cotool alert first, triaged in Cotool's alert queue
Clear enough to supply this argument.
newAlertDestinationIds
Slack notification destination IDs (from list_notification_destinations) to post each new alert to when the trigger creates one. The alert's status updates and escalations reply in that thread. Replaces the current list; empty turns it off
The title clearly communicates the tool’s action and subject. Keep it concise.
Description87/100
Change an alert's status, severity, title, or description, and optionally add a comment. Pass only what changes. Closing an alert records the verdict used to tune its detection, so only close when the user agrees with the verdict.
The description explains the capability, when to use it, and what to expect.
Inputs66/100
6 of 8 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
alertId
Alert UUID or display ID such as "COT-123"
Clear enough to supply this argument.
status
Alert lifecycle status a caller may set. `expired` is written only by the alert inactivity job and cannot be requested.
Clear enough to supply this argument.
duplicateOfAlertId
Required with status "duplicate": the alert this one duplicates
Clear enough to supply this argument.
severity
Not provided
Missing description. Explain what this value means and how to supply it.
title
Not provided
Missing description. Explain what this value means and how to supply it.
description
Markdown description; an empty string clears it
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
reason
Why the status or severity changed
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
comment
Markdown comment to add to the alert timeline
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description92/100
Show how new alerts are routed: the ordered triage routes that pick the agent that triages each alert, the default agent for alerts no route matches, the agent for Hunt Alerts, and the escalation routes that pick where escalated alerts are announced. escalation is null when the caller cannot read integrations. Use explain_alert_routing for where one detection or agent sends its alerts.
The description explains the capability, when to use it, and what to expect.
Inputs100/100
This tool declares no inputs, so argument descriptions are not needed.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description84/100
Preview where one code detection's or agent's new alerts go: the triage route and agent that pick them up and, once escalated, the escalation route and destinations notified. For an agent, also shows the alert sources routed to it. Pass exactly one of codeDetectionId and agentId.
The description explains the capability, when to use it, and what to expect.
Inputs0/100
0 of 2 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
codeDetectionId
Not provided
Missing description. Explain what this value means and how to supply it.
agentId
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description80/100
Change which agent triages new alerts. routes replaces the ordered route list: start from get_alert_routing, edit it, and pass back every saved route with its id (set enabled to false rather than leaving one out), plus any new ones without an id. Pass only the settings that change. Confirm the change with the user first.
The description explains the capability, when to use it, and what to expect.
Inputs84/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
routes › items › id
ID of a saved route; omit to add a new route
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
routes › items › name
Name shown in settings and wherever the route is credited
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
routes › items › enabled
Disabled routes are skipped
Clear enough to supply this argument.
routes › items › conditions › items › type
Which field below the condition uses
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description81/100
Change where escalated alerts are announced. routes replaces the ordered route list: start from get_alert_routing, edit it, and pass back every saved route with its id (set enabled to false rather than leaving one out), plus any new ones without an id. Pass only the settings that change. Confirm the change with the user first.
The description explains the capability, when to use it, and what to expect.
Inputs81/100
11 of 12 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
enabled
Whether escalating an alert sends notifications
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
minSeverity
Escalated alerts below this severity notify nobody
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
defaultDestinations › items › destinationId
Not provided
Missing description. Explain what this value means and how to supply it.
defaultDestinations › items › minSeverity
Only escalated alerts at or above this severity go to this destination; omitted, it takes every severity the escalation's minSeverity allows
Clear enough to supply this argument.
routes › items › id
ID of a saved route; omit to add a new route
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
routes › items › name
Name shown in settings and wherever the route is credited
Clear enough to supply this argument.
routes › items › enabled
Disabled routes are skipped
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description85/100
Search the organization's Cotool detections, most recently updated first; all of them when no filter is given. Each detection produces alerts or signals (produces). Use get_detection for a detection's schedule, metrics, and output.
The description explains the capability, when to use it, and what to expect.
Inputs50/100
4 of 6 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
query
Words that must all appear in the name, summary, how it works, actions, or MITRE technique IDs
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
mitreTechniqueId
Only detections mapped to this technique, e.g. T1078
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
toolName
Only detections that use this integration action
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
produces
Only detections that produce alerts, or only those that produce signals
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description93/100
Get a detection: what it detects and how, what it produces (alerts or signals), its schedule, its latest calibration, its 10 most recent hits, and its metrics: alert verdict counts and precision (overall and per version), the entities most often marked false positive, scheduled run success rate and recent errors, and hit and alert volume. For a detection that produces signals, signalOutput lists its signal types and which become alerts. Next: get_detection_logic for its code, list_detection_versions for its change history, list_detection_runs and list_detection_hits (alert detections) or search_detection_signals (signal detections), and search_alerts with detectionId for its alerts.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
detectionId
ID of the detection
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description76/100
Change a published detection's settings: whether it runs on a schedule, how often, the lowest severity that creates alerts, and whether tuning proposals apply automatically. Pass only what changes. A detection that produces signals can only be turned on or off (enabled).
Resolve contradictions between the description, input schema, and annotations.
Inputs65/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
detectionId
ID of the detection
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
enabled
Run on a schedule
Resolve the mismatch between this description and its schema constraints.
intervalMinutes
Minutes between runs: 10, 30, 60, 360, or 1440
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
minSeverity
Hits below this severity create no alert
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
autoApplyTuning
Apply tuning proposals without review; null follows the organization's default
The title clearly communicates the tool’s action and subject. Keep it concise.
Description95/100
Start Cotool's detection tuning agent on a detection that produces alerts. It studies the detection's alert verdicts (and your instructions), tests a change, and files a tuning proposal. If the detection auto-applies tuning (get_detection's schedule.autoApplyTuning, or schedule.autoApplyTuningDefault when that is null), a proposal that passes its quality gates is published without review; otherwise a person reviews it in Cotool. Runs take several minutes: follow the run at chatUrl, check for a proposal with get_detection_tuning_proposal, and see an auto-applied change in list_detection_versions.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
detectionId
ID of the detection
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
instructions
What to change or focus on, for example "stop alerting on our CI service accounts"
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"chatId",
"chatUrl",
"detectionUrl"
],
"properties": {
"chatId": {
"type": "string"
},
"chatUrl": {
"type": "string",
"description": "Link to the tuning agent's chat"
},
"detectionUrl": {
"type": "string",
"description": "Link to open this in Cotool"
}
},
"additionalProperties": false
}
Original tool metadata
{
"name": "start_detection_tuning",
"title": "Start detection tuning",
"description": "Start Cotool's detection tuning agent on a detection that produces alerts. It studies the detection's alert verdicts (and your instructions), tests a change, and files a tuning proposal. If the detection auto-applies tuning (get_detection's schedule.autoApplyTuning, or schedule.autoApplyTuningDefault when that is null), a proposal that passes its quality gates is published without review; otherwise a person reviews it in Cotool. Runs take several minutes: follow the run at chatUrl, check for a proposal with get_detection_tuning_proposal, and see an auto-applied change in list_detection_versions.",
"inputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"detectionId"
],
"properties": {
"detectionId": {
"type": "string",
"format": "uuid",
"description": "ID of the detection"
},
"instructions": {
"type": "string",
"maxLength": 4000,
"minLength": 1,
"description": "What to change or focus on, for example \"stop alerting on our CI service accounts\""
}
},
"additionalProperties": false
},
"outputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"chatId",
"chatUrl",
"detectionUrl"
],
"properties": {
"chatId": {
"type": "string"
},
"chatUrl": {
"type": "string",
"description": "Link to the tuning agent's chat"
},
"detectionUrl": {
"type": "string",
"description": "Link to open this in Cotool"
}
},
"additionalProperties": false
},
"annotations": {
"title": "Start detection tuning",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": false,
"destructiveHint": false
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description91/100
List a detection's published versions, newest first, with what changed in each (changeSummary in plain prose, changeDetails as technical bullets) and who or what changed it: authorSource is agent (Cotool's authoring or tuning agent), editor (a person in the editor), parameter_edit, revert, or library; authorUserId is null when a tuning proposal was applied automatically; tuningScorecard is set when the version came from a tuning proposal. Use get_detection_logic with a version's id for its code.
The description explains the capability, when to use it, and what to expect.
Inputs25/100
1 of 3 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
detectionId
ID of the detection
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description93/100
Get the code a detection runs (a Python notebook) and a step-by-step plain-language explanation of it, for the published version or any version from list_detection_versions. Also returns that version's change summary and author. To change the logic, use start_detection_tuning.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
detectionId
ID of the detection
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
versionId
Version to read; the published version when omitted
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description91/100
List the runs of a detection that produces alerts, newest first: scheduled, manual, and editor runs with status, the version run, timing, rows emitted, hits created, and the error when one failed. Run success rates and recent errors are summarized in get_detection's feedback.scheduledExecutions.
The description explains the capability, when to use it, and what to expect.
Inputs50/100
3 of 5 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
detectionId
ID of the detection
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
status
Only runs with this status
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
includeResultPreview
Include each run's first emitted rows
Clear enough to supply this argument.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description97/100
List the hits of a detection that produces alerts, newest first; for a detection that produces signals, use search_detection_signals. Each hit names the entity it fired on (a user, host, IP, or other entityType), with its severity, headline, summary, the emitted row as evidence, how often it was seen, and the alert it created with that alert's status and verdict. Use get_alert with linkedAlert.id for an alert, or search_alerts with detectionId for all of the detection's alerts.
The description explains the capability, when to use it, and what to expect.
Inputs45/100
3 of 5 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
detectionId
ID of the detection
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
alertStatus
Only hits whose alert has this status
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
query
Text to match in the entity, headline, or summary
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description88/100
List the findings Cotool labeled while calibrating a detection against past data (backtest) and live runs (observation): each with its entity, emitted row, label (false_positive, true_positive_benign, or true_positive_malicious), whether an agent or a person labeled it, and why. Shows why a detection is noisy or precise. The latest calibration attempt and its state are in get_detection's calibration.
The description explains the capability, when to use it, and what to expect.
Inputs44/100
2 of 4 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
detectionId
ID of the detection
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
attemptId
Only examples from this calibration attempt, e.g. get_detection's calibration.attempt.id
Clear enough to supply this argument.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description81/100
Get the organization's detection tuning defaults: whether tuning proposals apply without review for detections that follow the default (get_detection's schedule.autoApplyTuning is null), and where Cotool notifies when one is applied.
The description explains the capability, when to use it, and what to expect.
Inputs100/100
This tool declares no inputs, so argument descriptions are not needed.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description88/100
Change the organization's detection tuning defaults: whether tuning proposals apply without review for every detection that follows the default, and the notifications sent when one is applied. Pass only what changes. This affects all detections, so confirm the change with the user first. Destination IDs come from list_notification_destinations.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
autoApplyTuningDefault
Apply tuning proposals that pass their quality gates without review
Clear enough to supply this argument.
notifyOnAutoApply
Notify when a tuning proposal is applied automatically
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
notificationDestinationIds
Replaces the destinations notified
Clarify units, where to obtain this value, or conventions not already expressed in the schema.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description91/100
Start Cotool's detection authoring agent on a new code detection. It explores the organization's data in Cotool, writes a Python notebook, runs and tunes it, and saves it as a draft detection. It does not ask questions, so settle what to detect with the user first, and check list_library_detections for a prebuilt match before authoring one. Runs take several minutes: check on them with get_detection_authoring_run, and change the draft with send_detection_authoring_message. The draft does not run or alert until the user publishes it in Cotool.
The description explains the capability, when to use it, and what to expect.
Inputs88/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
objective
The behavior to detect, for example "a user signs in after 5 or more failed attempts within 10 minutes"
Clear enough to supply this argument.
dataSources
Integrations or log sources to read, from list_integrations; without them the agent finds the data
Clear enough to supply this argument.
exclusions
Expected activity that should not alert, such as service accounts or test users
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
context
Background such as threat intel, an incident summary, or a rule from another product to port
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"chatId",
"status",
"chatUrl"
],
"properties": {
"chatId": {
"type": "string"
},
"status": {
"type": "string",
"const": "running"
},
"chatUrl": {
"type": "string",
"description": "Link to the authoring agent's chat, where the user can follow it"
}
},
"additionalProperties": false
}
Original tool metadata
{
"name": "start_detection_authoring",
"title": "Start detection authoring",
"description": "Start Cotool's detection authoring agent on a new code detection. It explores the organization's data in Cotool, writes a Python notebook, runs and tunes it, and saves it as a draft detection. It does not ask questions, so settle what to detect with the user first, and check list_library_detections for a prebuilt match before authoring one. Runs take several minutes: check on them with get_detection_authoring_run, and change the draft with send_detection_authoring_message. The draft does not run or alert until the user publishes it in Cotool.",
"inputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"objective"
],
"properties": {
"context": {
"type": "string",
"maxLength": 20000,
"minLength": 1,
"description": "Background such as threat intel, an incident summary, or a rule from another product to port"
},
"objective": {
"type": "string",
"maxLength": 4000,
"minLength": 1,
"description": "The behavior to detect, for example \"a user signs in after 5 or more failed attempts within 10 minutes\""
},
"exclusions": {
"type": "string",
"maxLength": 4000,
"minLength": 1,
"description": "Expected activity that should not alert, such as service accounts or test users"
},
"dataSources": {
"type": "array",
"items": {
"type": "string",
"maxLength": 200,
"minLength": 1
},
"maxItems": 20,
"minItems": 1,
"description": "Integrations or log sources to read, from list_integrations; without them the agent finds the data"
}
},
"additionalProperties": false
},
"outputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"chatId",
"status",
"chatUrl"
],
"properties": {
"chatId": {
"type": "string"
},
"status": {
"type": "string",
"const": "running"
},
"chatUrl": {
"type": "string",
"description": "Link to the authoring agent's chat, where the user can follow it"
}
},
"additionalProperties": false
},
"annotations": {
"title": "Start detection authoring",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": false,
"destructiveHint": false
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description94/100
Get a detection authoring run's status and, once it finishes, the agent's summary of the draft: what it catches, its tunables, what the validation run emitted, and its limitations. drafted means a draft notebook is ready for the user to review and publish in Cotool at reviewUrl; no_draft means the agent explained in finalMessage why it wrote none.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
chatId
chatId from start_detection_authoring
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"status",
"statusMessage",
"detection",
"finalMessage",
"reviewUrl"
],
"properties": {
"status": {
"enum": [
"running",
"drafted",
"published",
"no_draft",
"failed"
],
"type": "string",
"description": "running: still working. drafted: a draft is saved. published: the user published it. no_draft: finished without one. failed: the run errored before saving one."
},
"detection": {
"anyOf": [
{
"type": "object",
"required": [
"id",
"name",
"url"
],
"properties": {
"id": {
"type": "string"
},
"url": {
"type": "string",
"description": "Link to open this in Cotool"
},
"name": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
},
{
"type": "null"
}
],
"description": "The draft detection, once the agent has saved one"
},
"reviewUrl": {
"type": "string",
"description": "Where the user reviews and publishes the draft: the authoring chat until it is published, then the detection"
},
"finalMessage": {
"type": [
"string",
"null"
],
"description": "The agent's latest final message"
},
"statusMessage": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
}
Original tool metadata
{
"name": "get_detection_authoring_run",
"title": "Get detection authoring run",
"description": "Get a detection authoring run's status and, once it finishes, the agent's summary of the draft: what it catches, its tunables, what the validation run emitted, and its limitations. drafted means a draft notebook is ready for the user to review and publish in Cotool at reviewUrl; no_draft means the agent explained in finalMessage why it wrote none.",
"inputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"chatId"
],
"properties": {
"chatId": {
"type": "string",
"format": "uuid",
"description": "chatId from start_detection_authoring"
}
},
"additionalProperties": false
},
"outputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"status",
"statusMessage",
"detection",
"finalMessage",
"reviewUrl"
],
"properties": {
"status": {
"enum": [
"running",
"drafted",
"published",
"no_draft",
"failed"
],
"type": "string",
"description": "running: still working. drafted: a draft is saved. published: the user published it. no_draft: finished without one. failed: the run errored before saving one."
},
"detection": {
"anyOf": [
{
"type": "object",
"required": [
"id",
"name",
"url"
],
"properties": {
"id": {
"type": "string"
},
"url": {
"type": "string",
"description": "Link to open this in Cotool"
},
"name": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
},
{
"type": "null"
}
],
"description": "The draft detection, once the agent has saved one"
},
"reviewUrl": {
"type": "string",
"description": "Where the user reviews and publishes the draft: the authoring chat until it is published, then the detection"
},
"finalMessage": {
"type": [
"string",
"null"
],
"description": "The agent's latest final message"
},
"statusMessage": {
"type": [
"string",
"null"
]
}
},
"additionalProperties": false
},
"annotations": {
"title": "Get detection authoring run",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description88/100
Send a follow-up to a finished detection authoring run, such as "also exclude the ci-deploy service account" or "use a 30 minute window". The agent changes the same draft, re-runs it, and answers in finalMessage; check get_detection_authoring_run until status is no longer running. A run that is still working refuses the message.
Describe the returned information so the agent knows whether it will answer the request.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
chatId
chatId from start_detection_authoring
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
message
Markdown
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description78/100
Get the Hunt dashboard: counts of intel ingested, threats tracked and assessed, Hunt Alerts, detection rule proposals and blocking observability gaps, the intel-to-exposure funnel, recent threats, rule proposals and gaps, and the threat actors you can filter search_threats by.
The description explains the capability, when to use it, and what to expect.
Inputs100/100
This tool declares no inputs, so argument descriptions are not needed.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description97/100
Search the Hunt threat catalog: vulnerabilities and campaigns from threat intel that Cotool assessed against this organization's environment. Returns summaries with status, scores, and deliverable counts; use get_threat for the assessment, detection rule proposals, and observability gaps.
The description explains the capability, when to use it, and what to expect.
Inputs35/100
4 of 10 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
query
Text to match in the title, canonical key, and aliases
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
status
Not provided
Missing description. Explain what this value means and how to supply it.
canonicalType
Not provided
Missing description. Explain what this value means and how to supply it.
coverageState
Whether existing detections cover the threat
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
exposureState
Not provided
Missing description. Explain what this value means and how to supply it.
huntResultBadge
Not provided
Missing description. Explain what this value means and how to supply it.
actorId
Threat actor ID from get_hunt_overview
Clear enough to supply this argument.
linkedAlertState
Whether the threat has an open, closed, or no Hunt Alert
Clear enough to supply this argument.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description85/100
Get a Hunt threat with its latest assessment (relevancy and exposure story), assessment history, the intel behind it, its deliverables (detection rule proposals and observability gaps), and its Hunt Alerts. Agent-written text may contain <cite id="..."> spans; pass those ids to get_hunt_evidence to see the tool calls behind them.
The description explains the capability, when to use it, and what to expect.
Inputs76/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
threatId
Threat ID
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
includeSupersededDeliverables
Also return deliverables replaced by a later assessment
The title clearly communicates the tool’s action and subject. Keep it concise.
Description83/100
Get the tool calls (queries and their results) that Cotool's hunt agents cited as evidence, for one threat assessment run (from get_threat) or one intel item (from get_threat_intel). Pass toolUseIds from <cite id="..."> spans to get just those.
The description explains the capability, when to use it, and what to expect.
Inputs60/100
3 of 5 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
assessmentRunId
Assessment run ID (latestAssessment.id from get_threat) or one of its execution IDs
Clear enough to supply this argument.
intelItemId
Intel item ID, for the evidence behind its relevancy check and exposure hunt
Clear enough to supply this argument.
toolUseIds
Only these cited tool calls
Clear enough to supply this argument.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description87/100
Search the threat intel feed (advisories and reports from the organization's intel sources), newest first, with each item's relevancy and exposure scores from Cotool's hunt. Use get_threat_intel for an item's full write-up, IOCs, and hunt results.
The description explains the capability, when to use it, and what to expect.
Inputs42/100
5 of 9 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
query
Text to search for
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
severity
Not provided
Missing description. Explain what this value means and how to supply it.
platform
Not provided
Missing description. Explain what this value means and how to supply it.
status
Not provided
Missing description. Explain what this value means and how to supply it.
source
Intel source name from list_intel_sources
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
relevantOnly
Only items the hunt found relevant to this organization's environment
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
minRelevancyScore
Only relevant items scoring at least this; implies relevantOnly
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
A multiple of limit
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description87/100
Get a threat intel item in full: summary, ATT&CK techniques, actors, malware, affected products, IOCs, and supporting passages, plus Cotool's hunt results for it (relevancy check and exposure hunt with IOC findings, assets, and gaps). Agent-written text may contain <cite id="..."> spans; pass those ids to get_hunt_evidence to see the tool calls behind them.
The description explains the capability, when to use it, and what to expect.
Inputs71/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
intelItemId
Intel item ID
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"item",
"relevancy",
"exposureHunt",
"huntResultsRestricted",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Link to open this in Cotool"
},
"item": {
"type": "object",
"required": [
"id",
"source",
"event",
"summary",
"tldr",
"attackPath",
"classification",
"affectedProducts",
"iocs",
"provenance",
"version"
],
"properties": {
"id": {
"type": "string"
},
"iocs": {
"type": "object",
"properties": {
"ipv4": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"ipv6": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"urls": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"certs": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"files": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"hashes": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"domains": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"cloudIds": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"mobileIds": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"processes": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"registryKeys": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
}
},
"description": "Grouped IOCs (read-tolerant).",
"additionalProperties": false
},
"tldr": {
"type": "string",
"maxLength": 240
},
"event": {
"type": "object",
"required": [
"title",
"severity",
"confidence",
"status"
],
"properties": {
"title": {
"type": "string"
},
"status": {
"enum": [
"active",
"corrected",
"retracted"
],
"type": "string"
},
"severity": {
"enum": [
"none",
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"eventLastSeen": {
"type": "string"
},
"eventFirstSeen": {
"type": "string"
}
},
"additionalProperties": false
},
"source": {
"type": "object",
"required": [
"url",
"publisher",
"publishTime",
"language"
],
"properties": {
"tlp": {
"enum": [
"CLEAR",
"GREEN",
"AMBER",
"AMBER+STRICT",
"RED"
],
"type": "string"
},
"url": {
"type": "string",
"format": "uri"
},
"name": {
"type": "string"
},
"license": {
"type": "string"
},
"language": {
"type": "string"
},
"publisher": {
"type": "string"
},
"publishTime": {
"type": "string"
}
},
"additionalProperties": false
},
"summary": {
"type": "string"
},
"version": {
"type": "integer",
"exclusiveMinimum": 0
},
"abstract": {
"type": "string"
},
"createdAt": {
"type": "string"
},
"attackPath": {
"type": "array",
"items": {
"type": "string"
}
},
"externalId": {
"type": "string"
},
"provenance": {
"type": "object",
"required": [
"supportingPassages"
],
"properties": {
"supportingPassages": {
"type": "array",
"items": {
"type": "object",
"required": [
"text"
],
"properties": {
"text": {
"type": "string",
"description": "Exact quoted text supporting a technical claim. Do not paraphrase."
},
"charSpan": {
"type": "object",
"required": [
"start",
"end"
],
"properties": {
"end": {
"type": "number",
"description": "End character offset (exclusive) of quoted span within the analyzed content."
},
"start": {
"type": "number",
"description": "Start character offset (inclusive) of quoted span within content."
}
},
"description": "Character span for the quoted passage within the analyzed content.",
"additionalProperties": false
},
"sourceUrl": {
"type": "string",
"format": "uri",
"description": "Optional URL if the passage is from a different source."
}
},
"description": "Supporting evidence passages used to justify extracted claims.",
"additionalProperties": false
},
"description": "Evidence snippets grounding technical claims and mappings. Use [] when no precise evidence exists."
}
},
"description": "Provenance information tying claims to exact sources/passages.",
"additionalProperties": false
},
"duplicateOf": {
"type": "string"
},
"lastUpdated": {
"type": "string"
},
"canonicalKey": {
"type": "string"
},
"addedToFeedAt": {
"type": "string"
},
"classification": {
"type": "object",
"required": [
"attack",
"killChain",
"malware",
"actor",
"platforms",
"mappings"
],
"properties": {
"actor": {
"type": "array",
"items": {
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Threat actor/group name."
},
"aliases": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known aliases for the actor/group."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
}
},
"description": "Threat actor attribution claim.",
"additionalProperties": false
}
},
"attack": {
"type": "array",
"items": {
"type": "object",
"properties": {
"technique": {
"type": "string"
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"evidenceRef": {
"type": "string",
"description": "Optional reference to supporting evidence (e.g., passage index or quote id)."
},
"subTechnique": {
"type": "string",
"description": "Sub-technique ID when applicable (e.g., T1059.001)."
},
"techniqueName": {
"type": "string",
"description": "Resolved human-readable technique name. Omit when unknown."
}
},
"description": "ATT&CK technique mapping with confidence. Include techniqueName when resolvable.",
"additionalProperties": false
}
},
"malware": {
"type": "array",
"items": {
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Malware family/tool name."
},
"aliases": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known aliases for the malware family/tool."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
}
},
"description": "Malware identification claim.",
"additionalProperties": false
}
},
"mappings": {
"type": "array",
"items": {
"type": "object",
"required": [
"framework",
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Framework control/technique identifier."
},
"framework": {
"type": "string",
"description": "Framework name (e.g., NIST, CIS)."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Optional confidence in mapping in [0,1]."
}
},
"description": "Mapping to other security frameworks.",
"additionalProperties": false
},
"description": "Mappings to other frameworks (e.g., NIST, CIS). Return [] when not applicable."
},
"killChain": {
"type": "array",
"items": {
"enum": [
"reconnaissance",
"weaponization",
"delivery",
"exploitation",
"installation",
"c2",
"actions"
],
"type": "string"
},
"description": "Relevant kill chain phases demonstrated in the content. Return [] when not evidenced."
},
"platforms": {
"type": "array",
"items": {
"enum": [
"windows",
"linux",
"macos",
"ios",
"android",
"aws",
"gcp",
"azure",
"o365",
"okta",
"kubernetes"
],
"type": "string"
},
"description": "Affected platforms/environments. Return [] when not stated."
}
},
"description": "Classification including ATT&CK mapping, kill chain phases, actors, malware, and platforms.",
"additionalProperties": false
},
"tenantOverrides": {},
"affectedProducts": {
"type": "array",
"items": {
"type": "object",
"properties": {
"vendor": {
"type": "string"
},
"product": {
"type": "string"
},
"versions": {
"type": "array",
"items": {
"type": "string"
},
"default": []
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Optional confidence in product impact in [0,1]."
},
"fixedVersions": {
"type": "array",
"items": {
"type": "string"
},
"default": [],
"description": "Minimum patched/secure versions of this product that remediate the issue, one per supported release line (e.g. [\"16.3.6\"] or [\"15.5.10\", \"16.3.6\"]). Only versions the source states as fixed; never guess. Use [] when the source names no fixed version."
}
},
"description": "Affected vendor/product versions relevant for scoping detections.",
"additionalProperties": false
}
}
},
"description": "Backwards-compatible intel item for read/API responses (tolerates legacy stored shapes).",
"additionalProperties": true
},
"relevancy": {
"anyOf": [
{
"type": "object",
"required": [
"relevancyScore",
"explanation",
"agentId",
"executionId",
"runAt",
"toolsUsed"
],
"properties": {
"runAt": {
"type": "string",
"format": "date-time",
"description": "ISO timestamp when the validation completed."
},
"agentId": {
"type": "string",
"format": "uuid"
},
"toolsUsed": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tool identifiers actually invoked during validation (e.g., \"splunk.query\", \"sentinelone.search\", \"aws.ec2.describe\")."
},
"executionId": {
"type": "string",
"format": "uuid"
},
"explanation": {
"type": "array",
"items": {
"type": "string",
"description": "One concise tool-backed finding. Wrap each clause supported by a tool call in <cite id=\"qN\">...</cite>. Example: Confirmed <cite id=\"q1\">12 macOS hosts</cite> running <cite id=\"q2\">vulnerable Atlas v3.1</cite>."
},
"description": "3-6 compact bullets citing specific tool observations about applicability, visibility, and gaps. Wrap the specific clause(s) backed by a tool call in inline citation spans of the form <cite id=\"qN\">...</cite>, where qN matches a <cotool_citation id=\"qN\" /> marker that preceded a tool result in this run."
},
"relevancyScore": {
"type": "number",
"maximum": 100,
"minimum": 0,
"description": "Single numeric score from 0-100 for how APPLICABLE the threat is to this organization — whether the affected products/platforms/versions/ecosystems/surface are present here. NOT about whether compromise was found or telemetry is complete. 70-100: affected surface confirmed present (proceed to hunt even with no compromise evidence / limited telemetry); 50-69: plausibly present, unconfirmed; 0-49: genuinely absent / not applicable. Do not lower the score for missing compromise evidence or telemetry gaps."
},
"relevancyHeadline": {
"type": "string",
"description": "ONE self-contained, answer-first sentence stating whether and why this threat applies to this environment — always include it. Lead with the conclusion, then the concrete reason (e.g. \"The Acrobat Chrome extension is not installed on any managed browser, so this threat does not apply.\"). Never lead with background inventory or scene-setting. Wrap tool-backed clauses in <cite id=\"qN\">...</cite> spans as in explanation."
}
},
"description": "Structured output for the built-in threat relevancy agent.",
"additionalProperties": true
},
{
"type": "null"
}
],
"description": "Whether the threat applies to this environment"
},
"exposureHunt": {
"anyOf": [
{
"type": "object",
"required": [
"exposureScore",
"exposureExplanation",
"agentId",
"executionId",
"runAt",
"toolsUsed"
],
"properties": {
"gaps": {
"type": "array",
"items": {
"type": "object",
"required": [
"product",
"logSource",
"description"
],
"properties": {
"product": {
"type": "string",
"description": "Product whose telemetry is missing/weak."
},
"blocking": {
"type": "boolean",
"description": "True when the gap blocked a reliable answer."
},
"logSource": {
"type": "string",
"description": "The missing/weak logs as a short plain-language description (1-3 words, e.g. \"DNS query logs\", \"CI/CD audit logs\") — human-readable words, never a snake_case/technical identifier."
},
"scopeType": {
"enum": [
"org",
"integration",
"account",
"environment",
"asset_group",
"tenant",
"domain"
],
"type": "string",
"description": "Scope of the gap; defaults to org."
},
"description": {
"type": "string",
"description": "Why the missing/weak log source blocked or weakened the hunt. May contain <cite> spans."
}
},
"additionalProperties": false
},
"description": "Observability gaps: missing or weak log sources that blocked or weakened this hunt."
},
"runAt": {
"type": "string",
"format": "date-time",
"description": "ISO timestamp when the threat hunt completed."
},
"assets": {
"type": "array",
"items": {
"type": "object",
"required": [
"identifier",
"kind"
],
"properties": {
"kind": {
"enum": [
"repository",
"host",
"service",
"cloud_resource",
"identity",
"package",
"domain",
"saas_account",
"container_image",
"other"
],
"type": "string",
"description": "What kind of asset this is. Pick the closest match; use \"other\" only when none fit."
},
"source": {
"type": "string",
"description": "Where the asset was OBSERVED — the tool/integration that surfaced it, e.g. \"CrowdStrike\", \"Datadog APM\", \"GitHub\". This is the evidence source, not necessarily where the asset lives."
},
"evidence": {
"type": "string",
"description": "Short cited note on why this asset drives exposure. May contain inline citation spans of the form <cite id=\"qN\">...</cite>."
},
"platform": {
"type": "string",
"description": "The brandable system the asset NATIVELY lives in / is managed from — e.g. \"github\"/\"gitlab\" for a repo, \"aws\"/\"gcp\"/\"azure\" for a cloud resource, \"okta\" for an identity — so we can show its logo. Set ONLY to where the asset resides, NOT the telemetry/SIEM tool you observed it through (a host seen in Splunk/CrowdStrike still has no platform unless it genuinely lives in a brandable product). Omit when there is no brandable home."
},
"identifier": {
"type": "string",
"description": "Asset identifier — hostname, asset id, instance id, ARN, repo, or account."
},
"internetFacing": {
"type": "boolean",
"description": "True when the asset is reachable from the internet, false when confirmed internal. Omit when unknown."
}
},
"additionalProperties": false
},
"description": "Concrete assets whose cited evidence drives exposure (e.g. vulnerable internet-facing hosts). Populate for exposure-found results even when no IOC was found; omit when no concrete asset was established."
},
"agentId": {
"type": "string",
"format": "uuid"
},
"headline": {
"type": "string",
"description": "ONE self-contained sentence: the verdict line rendered standalone on the Alert card/list, without the intel or the other bullets for context — always include it. It must answer \"why am I being shown this alert?\": state the concrete indicator/activity or exposure found, the affected system/account/environment, and the evidence-based interpretation that determines the score. If a match is attributable to security inspection, scanning, testing, or another evidenced benign cause, state both the match and that interpretation so the reader immediately understands why it is not concerning. Never use background/applicability context (platform presence, telemetry availability, intel restatement) as the headline, and never use bare back-references (\"Both IPs\", \"the IOCs\") that assume prior context. Wrap tool-backed clauses in <cite id=\"qN\">...</cite> spans as in exposureExplanation."
},
"timeline": {
"type": "array",
"items": {
"type": "object",
"required": [
"timestamp",
"description"
],
"properties": {
"timestamp": {
"type": "string",
"description": "ISO timestamp of the notable event."
},
"description": {
"type": "string",
"description": "Short description of what happened and where."
}
},
"additionalProperties": false
},
"description": "Optional, up to 10 items, ordered by time. Include only if notable events were established from tool evidence."
},
"toolsUsed": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tool identifiers actually invoked during the hunt (e.g., \"splunk.query\", \"crowdstrike.search\", \"vpcflow.scan\")."
},
"executionId": {
"type": "string",
"format": "uuid"
},
"iocFindings": {
"type": "array",
"items": {
"type": "object",
"required": [
"iocValue",
"found"
],
"properties": {
"role": {
"enum": [
"compromise",
"relevance"
],
"type": "string",
"default": "compromise",
"description": "Carry the role the indicator was given in the input: \"compromise\" for attacker-controlled/attacker-specific artifacts indicative on their own; \"relevance\" for legitimate/dual-use artifacts the threat uses, abuses, or targets (a match proves environment relevance, NEVER compromise on its own). Never promote \"relevance\" to \"compromise\" or demote \"compromise\" to \"relevance\". For an indicator you discovered yourself (not in the input), assign the role by the same test: would a credible match alone justify reporting a compromise signal?"
},
"found": {
"type": "boolean",
"description": "True if any credible matches were identified in tool results."
},
"iocType": {
"enum": [
"ip",
"domain",
"url",
"hash",
"file_path",
"process",
"registry_key",
"certificate",
"cloud_id",
"package",
"email",
"user_agent",
"mutex",
"other"
],
"type": "string",
"description": "Canonical indicator type: one of ip, domain, url, hash, file_path, process, registry_key, certificate, cloud_id, package, email, user_agent, mutex, other. Use the canonical type of the indicator you were given (or the closest match for one you discovered); use \"other\" only when none fit."
},
"evidence": {
"type": "string",
"description": "Short evidence note (≤280 chars): include minimal context such as a timestamp, log id, query reference, or snippet summary. Do not paste full logs. May contain inline citation spans of the form <cite id=\"qN\">...</cite> referencing the tool call that produced the finding."
},
"iocValue": {
"type": "string",
"description": "Exact indicator value that was searched."
},
"platform": {
"type": "string",
"description": "For package/image indicators, the registry/ecosystem it lives in (\"npm\", \"pypi\", \"nuget\", \"dockerhub\", \"github\") so its logo can be shown. Omit for domain/ip/hash indicators and anything with no brandable registry. Never the SIEM/EDR tool that detected it."
},
"affectedSystems": {
"type": "array",
"items": {
"type": "string"
},
"description": "Compact list of implicated assets (hostnames, asset ids, instance ids) if applicable."
}
},
"additionalProperties": false
},
"description": "Per-indicator results actually searched. Include only when indicators were checked; omit entirely if no indicator search was performed."
},
"exposureScore": {
"type": "number",
"maximum": 100,
"minimum": 0,
"description": "Single numeric score (0-100) estimating likelihood of exposure, based strictly on tool evidence. ~90-100: compromised; 60-89: suspicious activity; 1-59: no evidence; 0: unknown."
},
"detectionCoverage": {
"type": "object",
"required": [
"state"
],
"properties": {
"state": {
"enum": [
"none",
"partial",
"covered",
"unknown"
],
"type": "string",
"description": "Whether existing detections cover this threat."
},
"matches": {
"type": "array",
"items": {
"type": "object",
"required": [
"detectionName",
"coverage",
"rationale"
],
"properties": {
"source": {
"type": "string",
"description": "Detection engine / SIEM the rule lives in, lowercase key when known (e.g. \"datadog\", \"splunk\", \"scanner\", \"crowdstrike\", \"sentinelone\"). Drives the engine logo in the UI."
},
"coverage": {
"enum": [
"partial",
"covered",
"unknown"
],
"type": "string",
"description": "How well this detection covers the threat."
},
"rationale": {
"type": "string",
"description": "Cited evidence the detection is deployed, scoped, healthy, and matches. May contain <cite> spans."
},
"detectionId": {
"type": "string",
"description": "Detection id if a Cotool detection."
},
"detectionName": {
"type": "string",
"description": "Name of the matched detection."
}
},
"additionalProperties": false
},
"description": "Detections evaluated as covering this threat. Only covered/partial with cited deploy/scope/health/logic evidence."
}
},
"description": "Existing detection coverage assessment (separate axis from exposure).",
"additionalProperties": false
},
"exposureExplanation": {
"type": "array",
"items": {
"type": "string"
},
"description": "3-8 concise bullets summarizing the strongest findings that drive the score. Each bullet should reference specific tool evidence (hostnames, query ids, brief log snippet summaries). Wrap the specific clause(s) backed by a tool call in inline citation spans of the form <cite id=\"qN\">...</cite>, where qN matches a <cotool_citation id=\"qN\" /> marker that preceded a tool result in this run."
}
},
"additionalProperties": true
},
{
"type": "null"
}
],
"description": "What the hunt found in this environment"
},
"huntResultsRestricted": {
"type": "boolean",
"description": "True when hunt results exist but you can't read the hunt agent that produced them"
}
},
"additionalProperties": false
}
Original tool metadata
{
"name": "get_threat_intel",
"title": "Get threat intel",
"description": "Get a threat intel item in full: summary, ATT&CK techniques, actors, malware, affected products, IOCs, and supporting passages, plus Cotool's hunt results for it (relevancy check and exposure hunt with IOC findings, assets, and gaps). Agent-written text may contain <cite id=\"...\"> spans; pass those ids to get_hunt_evidence to see the tool calls behind them.",
"inputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"intelItemId"
],
"properties": {
"intelItemId": {
"type": "string",
"minLength": 1,
"description": "Intel item ID"
}
},
"additionalProperties": false
},
"outputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"item",
"relevancy",
"exposureHunt",
"huntResultsRestricted",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Link to open this in Cotool"
},
"item": {
"type": "object",
"required": [
"id",
"source",
"event",
"summary",
"tldr",
"attackPath",
"classification",
"affectedProducts",
"iocs",
"provenance",
"version"
],
"properties": {
"id": {
"type": "string"
},
"iocs": {
"type": "object",
"properties": {
"ipv4": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"ipv6": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"urls": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"certs": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"files": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"hashes": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"domains": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"cloudIds": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"mobileIds": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"processes": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
},
"registryKeys": {
"type": "array",
"items": {
"type": "object",
"required": [
"value"
],
"properties": {
"type": {
"type": "string"
},
"value": {
"type": "string",
"description": "Indicator value string as observed."
},
"status": {
"enum": [
"active",
"revoked",
"superseded",
"expired"
],
"type": "string"
},
"ttlDays": {
"type": "number",
"description": "Suggested TTL in days (domains≈30, IPs≈7, hashes≈365). Omit when unknown."
},
"lastSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was last observed. Omit when unknown."
},
"firstSeen": {
"type": "string",
"description": "ISO-8601 timestamp when IOC was first observed. Omit when unknown."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"indicatorRole": {
"enum": [
"compromise",
"relevance",
"reference"
],
"type": "string",
"description": "'compromise' (IOC) for attacker-controlled/attacker-specific artifacts indicative on their own; 'relevance' (IOR) for legitimate/dual-use artifacts the threat uses, abuses, or targets — a match proves environment relevance, never compromise; 'reference' for artifacts that merely locate the reporting (source/reference URLs, publishing platforms, researcher profiles). Missing means legacy data and is treated as 'compromise'."
},
"normalizedValue": {
"type": "string",
"description": "Optional normalized form (e.g., lowercase domain without trailing dot)."
}
},
"description": "A single indicator with role (compromise vs. relevance vs. reference), temporal context, and confidence.",
"additionalProperties": false
}
}
},
"description": "Grouped IOCs (read-tolerant).",
"additionalProperties": false
},
"tldr": {
"type": "string",
"maxLength": 240
},
"event": {
"type": "object",
"required": [
"title",
"severity",
"confidence",
"status"
],
"properties": {
"title": {
"type": "string"
},
"status": {
"enum": [
"active",
"corrected",
"retracted"
],
"type": "string"
},
"severity": {
"enum": [
"none",
"low",
"medium",
"high",
"critical"
],
"type": "string"
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"eventLastSeen": {
"type": "string"
},
"eventFirstSeen": {
"type": "string"
}
},
"additionalProperties": false
},
"source": {
"type": "object",
"required": [
"url",
"publisher",
"publishTime",
"language"
],
"properties": {
"tlp": {
"enum": [
"CLEAR",
"GREEN",
"AMBER",
"AMBER+STRICT",
"RED"
],
"type": "string"
},
"url": {
"type": "string",
"format": "uri"
},
"name": {
"type": "string"
},
"license": {
"type": "string"
},
"language": {
"type": "string"
},
"publisher": {
"type": "string"
},
"publishTime": {
"type": "string"
}
},
"additionalProperties": false
},
"summary": {
"type": "string"
},
"version": {
"type": "integer",
"exclusiveMinimum": 0
},
"abstract": {
"type": "string"
},
"createdAt": {
"type": "string"
},
"attackPath": {
"type": "array",
"items": {
"type": "string"
}
},
"externalId": {
"type": "string"
},
"provenance": {
"type": "object",
"required": [
"supportingPassages"
],
"properties": {
"supportingPassages": {
"type": "array",
"items": {
"type": "object",
"required": [
"text"
],
"properties": {
"text": {
"type": "string",
"description": "Exact quoted text supporting a technical claim. Do not paraphrase."
},
"charSpan": {
"type": "object",
"required": [
"start",
"end"
],
"properties": {
"end": {
"type": "number",
"description": "End character offset (exclusive) of quoted span within the analyzed content."
},
"start": {
"type": "number",
"description": "Start character offset (inclusive) of quoted span within content."
}
},
"description": "Character span for the quoted passage within the analyzed content.",
"additionalProperties": false
},
"sourceUrl": {
"type": "string",
"format": "uri",
"description": "Optional URL if the passage is from a different source."
}
},
"description": "Supporting evidence passages used to justify extracted claims.",
"additionalProperties": false
},
"description": "Evidence snippets grounding technical claims and mappings. Use [] when no precise evidence exists."
}
},
"description": "Provenance information tying claims to exact sources/passages.",
"additionalProperties": false
},
"duplicateOf": {
"type": "string"
},
"lastUpdated": {
"type": "string"
},
"canonicalKey": {
"type": "string"
},
"addedToFeedAt": {
"type": "string"
},
"classification": {
"type": "object",
"required": [
"attack",
"killChain",
"malware",
"actor",
"platforms",
"mappings"
],
"properties": {
"actor": {
"type": "array",
"items": {
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Threat actor/group name."
},
"aliases": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known aliases for the actor/group."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
}
},
"description": "Threat actor attribution claim.",
"additionalProperties": false
}
},
"attack": {
"type": "array",
"items": {
"type": "object",
"properties": {
"technique": {
"type": "string"
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
},
"evidenceRef": {
"type": "string",
"description": "Optional reference to supporting evidence (e.g., passage index or quote id)."
},
"subTechnique": {
"type": "string",
"description": "Sub-technique ID when applicable (e.g., T1059.001)."
},
"techniqueName": {
"type": "string",
"description": "Resolved human-readable technique name. Omit when unknown."
}
},
"description": "ATT&CK technique mapping with confidence. Include techniqueName when resolvable.",
"additionalProperties": false
}
},
"malware": {
"type": "array",
"items": {
"type": "object",
"required": [
"name"
],
"properties": {
"name": {
"type": "string",
"description": "Malware family/tool name."
},
"aliases": {
"type": "array",
"items": {
"type": "string"
},
"description": "Known aliases for the malware family/tool."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0
}
},
"description": "Malware identification claim.",
"additionalProperties": false
}
},
"mappings": {
"type": "array",
"items": {
"type": "object",
"required": [
"framework",
"id"
],
"properties": {
"id": {
"type": "string",
"description": "Framework control/technique identifier."
},
"framework": {
"type": "string",
"description": "Framework name (e.g., NIST, CIS)."
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Optional confidence in mapping in [0,1]."
}
},
"description": "Mapping to other security frameworks.",
"additionalProperties": false
},
"description": "Mappings to other frameworks (e.g., NIST, CIS). Return [] when not applicable."
},
"killChain": {
"type": "array",
"items": {
"enum": [
"reconnaissance",
"weaponization",
"delivery",
"exploitation",
"installation",
"c2",
"actions"
],
"type": "string"
},
"description": "Relevant kill chain phases demonstrated in the content. Return [] when not evidenced."
},
"platforms": {
"type": "array",
"items": {
"enum": [
"windows",
"linux",
"macos",
"ios",
"android",
"aws",
"gcp",
"azure",
"o365",
"okta",
"kubernetes"
],
"type": "string"
},
"description": "Affected platforms/environments. Return [] when not stated."
}
},
"description": "Classification including ATT&CK mapping, kill chain phases, actors, malware, and platforms.",
"additionalProperties": false
},
"tenantOverrides": {},
"affectedProducts": {
"type": "array",
"items": {
"type": "object",
"properties": {
"vendor": {
"type": "string"
},
"product": {
"type": "string"
},
"versions": {
"type": "array",
"items": {
"type": "string"
},
"default": []
},
"confidence": {
"type": "number",
"maximum": 1,
"minimum": 0,
"description": "Optional confidence in product impact in [0,1]."
},
"fixedVersions": {
"type": "array",
"items": {
"type": "string"
},
"default": [],
"description": "Minimum patched/secure versions of this product that remediate the issue, one per supported release line (e.g. [\"16.3.6\"] or [\"15.5.10\", \"16.3.6\"]). Only versions the source states as fixed; never guess. Use [] when the source names no fixed version."
}
},
"description": "Affected vendor/product versions relevant for scoping detections.",
"additionalProperties": false
}
}
},
"description": "Backwards-compatible intel item for read/API responses (tolerates legacy stored shapes).",
"additionalProperties": true
},
"relevancy": {
"anyOf": [
{
"type": "object",
"required": [
"relevancyScore",
"explanation",
"agentId",
"executionId",
"runAt",
"toolsUsed"
],
"properties": {
"runAt": {
"type": "string",
"format": "date-time",
"description": "ISO timestamp when the validation completed."
},
"agentId": {
"type": "string",
"format": "uuid"
},
"toolsUsed": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tool identifiers actually invoked during validation (e.g., \"splunk.query\", \"sentinelone.search\", \"aws.ec2.describe\")."
},
"executionId": {
"type": "string",
"format": "uuid"
},
"explanation": {
"type": "array",
"items": {
"type": "string",
"description": "One concise tool-backed finding. Wrap each clause supported by a tool call in <cite id=\"qN\">...</cite>. Example: Confirmed <cite id=\"q1\">12 macOS hosts</cite> running <cite id=\"q2\">vulnerable Atlas v3.1</cite>."
},
"description": "3-6 compact bullets citing specific tool observations about applicability, visibility, and gaps. Wrap the specific clause(s) backed by a tool call in inline citation spans of the form <cite id=\"qN\">...</cite>, where qN matches a <cotool_citation id=\"qN\" /> marker that preceded a tool result in this run."
},
"relevancyScore": {
"type": "number",
"maximum": 100,
"minimum": 0,
"description": "Single numeric score from 0-100 for how APPLICABLE the threat is to this organization — whether the affected products/platforms/versions/ecosystems/surface are present here. NOT about whether compromise was found or telemetry is complete. 70-100: affected surface confirmed present (proceed to hunt even with no compromise evidence / limited telemetry); 50-69: plausibly present, unconfirmed; 0-49: genuinely absent / not applicable. Do not lower the score for missing compromise evidence or telemetry gaps."
},
"relevancyHeadline": {
"type": "string",
"description": "ONE self-contained, answer-first sentence stating whether and why this threat applies to this environment — always include it. Lead with the conclusion, then the concrete reason (e.g. \"The Acrobat Chrome extension is not installed on any managed browser, so this threat does not apply.\"). Never lead with background inventory or scene-setting. Wrap tool-backed clauses in <cite id=\"qN\">...</cite> spans as in explanation."
}
},
"description": "Structured output for the built-in threat relevancy agent.",
"additionalProperties": true
},
{
"type": "null"
}
],
"description": "Whether the threat applies to this environment"
},
"exposureHunt": {
"anyOf": [
{
"type": "object",
"required": [
"exposureScore",
"exposureExplanation",
"agentId",
"executionId",
"runAt",
"toolsUsed"
],
"properties": {
"gaps": {
"type": "array",
"items": {
"type": "object",
"required": [
"product",
"logSource",
"description"
],
"properties": {
"product": {
"type": "string",
"description": "Product whose telemetry is missing/weak."
},
"blocking": {
"type": "boolean",
"description": "True when the gap blocked a reliable answer."
},
"logSource": {
"type": "string",
"description": "The missing/weak logs as a short plain-language description (1-3 words, e.g. \"DNS query logs\", \"CI/CD audit logs\") — human-readable words, never a snake_case/technical identifier."
},
"scopeType": {
"enum": [
"org",
"integration",
"account",
"environment",
"asset_group",
"tenant",
"domain"
],
"type": "string",
"description": "Scope of the gap; defaults to org."
},
"description": {
"type": "string",
"description": "Why the missing/weak log source blocked or weakened the hunt. May contain <cite> spans."
}
},
"additionalProperties": false
},
"description": "Observability gaps: missing or weak log sources that blocked or weakened this hunt."
},
"runAt": {
"type": "string",
"format": "date-time",
"description": "ISO timestamp when the threat hunt completed."
},
"assets": {
"type": "array",
"items": {
"type": "object",
"required": [
"identifier",
"kind"
],
"properties": {
"kind": {
"enum": [
"repository",
"host",
"service",
"cloud_resource",
"identity",
"package",
"domain",
"saas_account",
"container_image",
"other"
],
"type": "string",
"description": "What kind of asset this is. Pick the closest match; use \"other\" only when none fit."
},
"source": {
"type": "string",
"description": "Where the asset was OBSERVED — the tool/integration that surfaced it, e.g. \"CrowdStrike\", \"Datadog APM\", \"GitHub\". This is the evidence source, not necessarily where the asset lives."
},
"evidence": {
"type": "string",
"description": "Short cited note on why this asset drives exposure. May contain inline citation spans of the form <cite id=\"qN\">...</cite>."
},
"platform": {
"type": "string",
"description": "The brandable system the asset NATIVELY lives in / is managed from — e.g. \"github\"/\"gitlab\" for a repo, \"aws\"/\"gcp\"/\"azure\" for a cloud resource, \"okta\" for an identity — so we can show its logo. Set ONLY to where the asset resides, NOT the telemetry/SIEM tool you observed it through (a host seen in Splunk/CrowdStrike still has no platform unless it genuinely lives in a brandable product). Omit when there is no brandable home."
},
"identifier": {
"type": "string",
"description": "Asset identifier — hostname, asset id, instance id, ARN, repo, or account."
},
"internetFacing": {
"type": "boolean",
"description": "True when the asset is reachable from the internet, false when confirmed internal. Omit when unknown."
}
},
"additionalProperties": false
},
"description": "Concrete assets whose cited evidence drives exposure (e.g. vulnerable internet-facing hosts). Populate for exposure-found results even when no IOC was found; omit when no concrete asset was established."
},
"agentId": {
"type": "string",
"format": "uuid"
},
"headline": {
"type": "string",
"description": "ONE self-contained sentence: the verdict line rendered standalone on the Alert card/list, without the intel or the other bullets for context — always include it. It must answer \"why am I being shown this alert?\": state the concrete indicator/activity or exposure found, the affected system/account/environment, and the evidence-based interpretation that determines the score. If a match is attributable to security inspection, scanning, testing, or another evidenced benign cause, state both the match and that interpretation so the reader immediately understands why it is not concerning. Never use background/applicability context (platform presence, telemetry availability, intel restatement) as the headline, and never use bare back-references (\"Both IPs\", \"the IOCs\") that assume prior context. Wrap tool-backed clauses in <cite id=\"qN\">...</cite> spans as in exposureExplanation."
},
"timeline": {
"type": "array",
"items": {
"type": "object",
"required": [
"timestamp",
"description"
],
"properties": {
"timestamp": {
"type": "string",
"description": "ISO timestamp of the notable event."
},
"description": {
"type": "string",
"description": "Short description of what happened and where."
}
},
"additionalProperties": false
},
"description": "Optional, up to 10 items, ordered by time. Include only if notable events were established from tool evidence."
},
"toolsUsed": {
"type": "array",
"items": {
"type": "string"
},
"description": "Tool identifiers actually invoked during the hunt (e.g., \"splunk.query\", \"crowdstrike.search\", \"vpcflow.scan\")."
},
"executionId": {
"type": "string",
"format": "uuid"
},
"iocFindings": {
"type": "array",
"items": {
"type": "object",
"required": [
"iocValue",
"found"
],
"properties": {
"role": {
"enum": [
"compromise",
"relevance"
],
"type": "string",
"default": "compromise",
"description": "Carry the role the indicator was given in the input: \"compromise\" for attacker-controlled/attacker-specific artifacts indicative on their own; \"relevance\" for legitimate/dual-use artifacts the threat uses, abuses, or targets (a match proves environment relevance, NEVER compromise on its own). Never promote \"relevance\" to \"compromise\" or demote \"compromise\" to \"relevance\". For an indicator you discovered yourself (not in the input), assign the role by the same test: would a credible match alone justify reporting a compromise signal?"
},
"found": {
"type": "boolean",
"description": "True if any credible matches were identified in tool results."
},
"iocType": {
"enum": [
"ip",
"domain",
"url",
"hash",
"file_path",
"process",
"registry_key",
"certificate",
"cloud_id",
"package",
"email",
"user_agent",
"mutex",
"other"
],
"type": "string",
"description": "Canonical indicator type: one of ip, domain, url, hash, file_path, process, registry_key, certificate, cloud_id, package, email, user_agent, mutex, other. Use the canonical type of the indicator you were given (or the closest match for one you discovered); use \"other\" only when none fit."
},
"evidence": {
"type": "string",
"description": "Short evidence note (≤280 chars): include minimal context such as a timestamp, log id, query reference, or snippet summary. Do not paste full logs. May contain inline citation spans of the form <cite id=\"qN\">...</cite> referencing the tool call that produced the finding."
},
"iocValue": {
"type": "string",
"description": "Exact indicator value that was searched."
},
"platform": {
"type": "string",
"description": "For package/image indicators, the registry/ecosystem it lives in (\"npm\", \"pypi\", \"nuget\", \"dockerhub\", \"github\") so its logo can be shown. Omit for domain/ip/hash indicators and anything with no brandable registry. Never the SIEM/EDR tool that detected it."
},
"affectedSystems": {
"type": "array",
"items": {
"type": "string"
},
"description": "Compact list of implicated assets (hostnames, asset ids, instance ids) if applicable."
}
},
"additionalProperties": false
},
"description": "Per-indicator results actually searched. Include only when indicators were checked; omit entirely if no indicator search was performed."
},
"exposureScore": {
"type": "number",
"maximum": 100,
"minimum": 0,
"description": "Single numeric score (0-100) estimating likelihood of exposure, based strictly on tool evidence. ~90-100: compromised; 60-89: suspicious activity; 1-59: no evidence; 0: unknown."
},
"detectionCoverage": {
"type": "object",
"required": [
"state"
],
"properties": {
"state": {
"enum": [
"none",
"partial",
"covered",
"unknown"
],
"type": "string",
"description": "Whether existing detections cover this threat."
},
"matches": {
"type": "array",
"items": {
"type": "object",
"required": [
"detectionName",
"coverage",
"rationale"
],
"properties": {
"source": {
"type": "string",
"description": "Detection engine / SIEM the rule lives in, lowercase key when known (e.g. \"datadog\", \"splunk\", \"scanner\", \"crowdstrike\", \"sentinelone\"). Drives the engine logo in the UI."
},
"coverage": {
"enum": [
"partial",
"covered",
"unknown"
],
"type": "string",
"description": "How well this detection covers the threat."
},
"rationale": {
"type": "string",
"description": "Cited evidence the detection is deployed, scoped, healthy, and matches. May contain <cite> spans."
},
"detectionId": {
"type": "string",
"description": "Detection id if a Cotool detection."
},
"detectionName": {
"type": "string",
"description": "Name of the matched detection."
}
},
"additionalProperties": false
},
"description": "Detections evaluated as covering this threat. Only covered/partial with cited deploy/scope/health/logic evidence."
}
},
"description": "Existing detection coverage assessment (separate axis from exposure).",
"additionalProperties": false
},
"exposureExplanation": {
"type": "array",
"items": {
"type": "string"
},
"description": "3-8 concise bullets summarizing the strongest findings that drive the score. Each bullet should reference specific tool evidence (hostnames, query ids, brief log snippet summaries). Wrap the specific clause(s) backed by a tool call in inline citation spans of the form <cite id=\"qN\">...</cite>, where qN matches a <cotool_citation id=\"qN\" /> marker that preceded a tool result in this run."
}
},
"additionalProperties": true
},
{
"type": "null"
}
],
"description": "What the hunt found in this environment"
},
"huntResultsRestricted": {
"type": "boolean",
"description": "True when hunt results exist but you can't read the hunt agent that produced them"
}
},
"additionalProperties": false
},
"annotations": {
"title": "Get threat intel",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description79/100
Search indicators of compromise from the threat intel feed, with whether the hunt found each one in this environment (found, clean, unchecked, or unknown). Use get_threat_intel with intelItemId for the intel an IOC came from.
The description explains the capability, when to use it, and what to expect.
Inputs45/100
3 of 5 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
query
Text to match in the indicator value or intel title
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
status
Not provided
Missing description. Explain what this value means and how to supply it.
type
Indicator type, one of availableTypes
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
A multiple of limit
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description86/100
Get detection coverage across MITRE ATT&CK: per-tactic counts of covered techniques, and techniques with how many of the organization's detections map to them. Filter by tactic, technique IDs, name, or covered/uncovered to find gaps.
The description explains the capability, when to use it, and what to expect.
Inputs66/100
6 of 8 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
tactic
Tactic ID, short name, or name, such as "TA0006", "credential-access", or "Credential Access"
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
techniqueIds
Only these techniques, such as "T1078" or "T1059.001"
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
query
Text to match in technique names
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
coverage
Covered means at least one detection maps to it
Clear enough to supply this argument.
includeSubtechniques
Also list subtechniques; on when techniqueIds is set
Clear enough to supply this argument.
includeDetections
List the detections mapped to each technique
Clear enough to supply this argument.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
offset
Not provided
Missing description. Explain what this value means and how to supply it.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"minimumExposureBand",
"alertOnCompromiseBelowThreshold",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Link to open this in Cotool"
},
"minimumExposureBand": {
"enum": [
"medium",
"high",
"critical"
],
"type": "string",
"description": "Exposure band from which an assessment opens or reopens a Hunt Alert: medium (score 60+), high (70+), or critical (85+)"
},
"alertOnCompromiseBelowThreshold": {
"type": "boolean",
"description": "Whether a live compromise signal opens a Hunt Alert even below the minimum band"
}
},
"additionalProperties": false
}
Original tool metadata
{
"name": "get_hunt_settings",
"title": "Get Hunt settings",
"description": "Get the organization-wide settings that decide when a threat assessment opens or reopens a Hunt Alert.",
"inputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {},
"additionalProperties": false
},
"outputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"minimumExposureBand",
"alertOnCompromiseBelowThreshold",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Link to open this in Cotool"
},
"minimumExposureBand": {
"enum": [
"medium",
"high",
"critical"
],
"type": "string",
"description": "Exposure band from which an assessment opens or reopens a Hunt Alert: medium (score 60+), high (70+), or critical (85+)"
},
"alertOnCompromiseBelowThreshold": {
"type": "boolean",
"description": "Whether a live compromise signal opens a Hunt Alert even below the minimum band"
}
},
"additionalProperties": false
},
"annotations": {
"title": "Get Hunt settings",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description87/100
Change when threat assessments open or reopen Hunt Alerts, for the whole organization. Pass only what changes. Confirm the change with the user first, since it changes which threats alert.
The description explains the capability, when to use it, and what to expect.
Inputs88/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
minimumExposureBand
Exposure band from which an assessment opens or reopens a Hunt Alert: medium (score 60+), high (70+), or critical (85+)
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
alertOnCompromiseBelowThreshold
Whether a live compromise signal opens a Hunt Alert even below the minimum band
Describe the returned fields so an agent can interpret the result.
View output schema
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"changed",
"previous",
"settings",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Link to open this in Cotool"
},
"changed": {
"type": "boolean"
},
"previous": {
"type": "object",
"required": [
"minimumExposureBand",
"alertOnCompromiseBelowThreshold"
],
"properties": {
"minimumExposureBand": {
"enum": [
"medium",
"high",
"critical"
],
"type": "string",
"description": "Exposure band from which an assessment opens or reopens a Hunt Alert: medium (score 60+), high (70+), or critical (85+)"
},
"alertOnCompromiseBelowThreshold": {
"type": "boolean",
"description": "Whether a live compromise signal opens a Hunt Alert even below the minimum band"
}
},
"additionalProperties": false
},
"settings": {
"type": "object",
"required": [
"minimumExposureBand",
"alertOnCompromiseBelowThreshold"
],
"properties": {
"minimumExposureBand": {
"enum": [
"medium",
"high",
"critical"
],
"type": "string",
"description": "Exposure band from which an assessment opens or reopens a Hunt Alert: medium (score 60+), high (70+), or critical (85+)"
},
"alertOnCompromiseBelowThreshold": {
"type": "boolean",
"description": "Whether a live compromise signal opens a Hunt Alert even below the minimum band"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
Original tool metadata
{
"name": "update_hunt_settings",
"title": "Update Hunt settings",
"description": "Change when threat assessments open or reopen Hunt Alerts, for the whole organization. Pass only what changes. Confirm the change with the user first, since it changes which threats alert.",
"inputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"properties": {
"minimumExposureBand": {
"enum": [
"medium",
"high",
"critical"
],
"type": "string",
"description": "Exposure band from which an assessment opens or reopens a Hunt Alert: medium (score 60+), high (70+), or critical (85+)"
},
"alertOnCompromiseBelowThreshold": {
"type": "boolean",
"description": "Whether a live compromise signal opens a Hunt Alert even below the minimum band"
}
},
"additionalProperties": false
},
"outputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"changed",
"previous",
"settings",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Link to open this in Cotool"
},
"changed": {
"type": "boolean"
},
"previous": {
"type": "object",
"required": [
"minimumExposureBand",
"alertOnCompromiseBelowThreshold"
],
"properties": {
"minimumExposureBand": {
"enum": [
"medium",
"high",
"critical"
],
"type": "string",
"description": "Exposure band from which an assessment opens or reopens a Hunt Alert: medium (score 60+), high (70+), or critical (85+)"
},
"alertOnCompromiseBelowThreshold": {
"type": "boolean",
"description": "Whether a live compromise signal opens a Hunt Alert even below the minimum band"
}
},
"additionalProperties": false
},
"settings": {
"type": "object",
"required": [
"minimumExposureBand",
"alertOnCompromiseBelowThreshold"
],
"properties": {
"minimumExposureBand": {
"enum": [
"medium",
"high",
"critical"
],
"type": "string",
"description": "Exposure band from which an assessment opens or reopens a Hunt Alert: medium (score 60+), high (70+), or critical (85+)"
},
"alertOnCompromiseBelowThreshold": {
"type": "boolean",
"description": "Whether a live compromise signal opens a Hunt Alert even below the minimum band"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"annotations": {
"title": "Update Hunt settings",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description80/100
List where Cotool sends detection hits and agent results: Slack channels, PagerDuty, Linear, Tines, Teams, and webhooks. Webhook and Teams URLs and tokens are never included.
The description explains the capability, when to use it, and what to expect.
Inputs100/100
This tool declares no inputs, so argument descriptions are not needed.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description74/100
Add a Slack or PagerDuty destination for detection hits and agent results. The Slack or PagerDuty integration must already be connected. Webhook, Teams, Linear, and Tines destinations need URLs, tokens, or team choices, so send the user the url to add those in Cotool.
The description explains the capability, when to use it, and what to expect.
Inputs38/100
2 of 4 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
type
Not provided
Missing description. Explain what this value means and how to supply it.
name
Not provided
Missing description. Explain what this value means and how to supply it.
slackChannels
Required for slack: channel names such as #security, or IDs. The Cotool app must already be in each channel
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
severity
pagerduty only: default severity for incidents (defaults to warning)
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description93/100
Send an example detection hit to a destination so the user can confirm it arrives. The send is real: it posts a Slack message, opens a PagerDuty incident, or files an issue. Confirm with the user first.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
destinationId
Destination from list_notification_destinations
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description71/100
Run a read-only ClickHouse SQL query over Cotool Logs, the logs Cotool ingests for the organization. Filter on time columns and select only the columns you need.
Describe the returned information so the agent knows whether it will answer the request.
Inputs38/100
1 of 2 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
query
ClickHouse SQL SELECT statement
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
maxRows
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description89/100
List an integration's log streams Cotool can ingest into Cotool Logs and which are on. Ingested logs power query_logs and library detections. blockedReason and missingCredentials describe the integration's setup, not the user's Cotool access: tell the user what to add or fix and send the url, and don't call it a permissions problem.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
toolId
Integration type from list_integrations, e.g. okta or crowdstrike
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description87/100
Turn log streams on or off for an integration. Only change streams the user opted into. A stream with a blockedReason or missingCredentials cannot be turned on until the user fixes that in Cotool at the url. blockedReason and missingCredentials describe the integration's setup, not the user's Cotool access: tell the user what to add or fix and send the url, and don't call it a permissions problem.
The description explains the capability, when to use it, and what to expect.
Inputs50/100
2 of 3 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
toolId
Integration type from list_integrations, e.g. okta or crowdstrike
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
streams › items › id
Stream id from get_log_ingest_settings
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
streams › items › enabled
Not provided
Missing description. Explain what this value means and how to supply it.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"toolId",
"connected",
"streams",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Link to open this in Cotool"
},
"toolId": {
"type": "string"
},
"streams": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"label",
"enabled"
],
"properties": {
"id": {
"type": "string",
"description": "Stable stream identifier from the tool definition"
},
"label": {
"type": "string"
},
"enabled": {
"type": "boolean"
},
"comingSoon": {
"type": "boolean",
"description": "Stream is advertised but cannot be enabled yet"
},
"description": {
"type": "string"
},
"blockedReason": {
"type": [
"string",
"null"
],
"description": "Why the connected credential cannot serve this stream right now (e.g. a missing provider permission). Enabling is refused while set; an already-enabled stream skips its runs."
},
"missingCredentials": {
"type": "array",
"items": {
"type": "string"
},
"description": "Labels of the ingest credential fields this stream needs that are not added yet. The stream cannot be turned on until someone adds them on the log ingest settings page."
}
},
"additionalProperties": false
}
},
"connected": {
"type": "boolean"
}
},
"additionalProperties": false
}
Original tool metadata
{
"name": "update_log_ingest_settings",
"title": "Update log ingest settings",
"description": "Turn log streams on or off for an integration. Only change streams the user opted into. A stream with a blockedReason or missingCredentials cannot be turned on until the user fixes that in Cotool at the url. blockedReason and missingCredentials describe the integration's setup, not the user's Cotool access: tell the user what to add or fix and send the url, and don't call it a permissions problem.",
"inputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"toolId",
"streams"
],
"properties": {
"toolId": {
"type": "string",
"maxLength": 100,
"minLength": 1,
"description": "Integration type from list_integrations, e.g. okta or crowdstrike"
},
"streams": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"enabled"
],
"properties": {
"id": {
"type": "string",
"minLength": 1,
"description": "Stream id from get_log_ingest_settings"
},
"enabled": {
"type": "boolean"
}
},
"additionalProperties": false
},
"maxItems": 50,
"minItems": 1
}
},
"additionalProperties": false
},
"outputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"toolId",
"connected",
"streams",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Link to open this in Cotool"
},
"toolId": {
"type": "string"
},
"streams": {
"type": "array",
"items": {
"type": "object",
"required": [
"id",
"label",
"enabled"
],
"properties": {
"id": {
"type": "string",
"description": "Stable stream identifier from the tool definition"
},
"label": {
"type": "string"
},
"enabled": {
"type": "boolean"
},
"comingSoon": {
"type": "boolean",
"description": "Stream is advertised but cannot be enabled yet"
},
"description": {
"type": "string"
},
"blockedReason": {
"type": [
"string",
"null"
],
"description": "Why the connected credential cannot serve this stream right now (e.g. a missing provider permission). Enabling is refused while set; an already-enabled stream skips its runs."
},
"missingCredentials": {
"type": "array",
"items": {
"type": "string"
},
"description": "Labels of the ingest credential fields this stream needs that are not added yet. The stream cannot be turned on until someone adds them on the log ingest settings page."
}
},
"additionalProperties": false
}
},
"connected": {
"type": "boolean"
}
},
"additionalProperties": false
},
"annotations": {
"title": "Update log ingest settings",
"readOnlyHint": false,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description84/100
List Cotool's library of prebuilt detections, whether each can run on the organization's ingested logs and connected tools, and which are already added. Add one with add_library_detection.
Describe the returned information so the agent knows whether it will answer the request.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
eligibleOnly
Only entries the organization can run now
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description80/100
Add a library detection to the organization. It goes live right away: Cotool publishes it and turns on its default schedule, so it starts running and can raise alerts. Only add entries the user chose, and only eligible ones from list_library_detections. Change its schedule with update_detection.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
slug
Entry slug from list_library_detections
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description93/100
Check whether logs are flowing into Cotool Logs: each ingest stream's state (healthy, backfilling, recovering, degraded, stale shown as "Stalled", failing, waiting, disconnected shown as "No access", meaning Cotool lost access to the integration, not that the user lacks Cotool access), why, what to do, its last error, how far behind it is, and events indexed in the last hour. Filter by integration, source, or state.
The description explains the capability, when to use it, and what to expect.
Inputs45/100
3 of 5 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
toolId
Integration type from list_integrations, e.g. okta or crowdstrike
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
source
Ingest source, e.g. google_workspace
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
states
Only streams in these states
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
offset
Not provided
Missing description. Explain what this value means and how to supply it.
limit
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description88/100
Show how one ingest stream's state changed over a window, from status samples taken every five minutes, as periods of the same state. Use it to tell when a stream started failing or stalling.
The description explains the capability, when to use it, and what to expect.
Inputs44/100
3 of 4 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
source
Ingest source from get_ingest_health
Explain the meaning of this value, not just its name.
stream
Stream from get_ingest_health
Explain the meaning of this value, not just its name.
ingestSourceId
From get_ingest_health, for named sources
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
hours
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description79/100
Get where Cotool notifies the organization when a log ingest stream turns failing, stalled, degraded, or loses access, and which of those states notify.
The description explains the capability, when to use it, and what to expect.
Inputs100/100
This tool declares no inputs, so argument descriptions are not needed.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description85/100
Change log ingest health notifications: turn them on or off, choose which stream states notify, or replace the destinations notified. Omitted fields keep their current value. Confirm the change with the user first.
The description explains the capability, when to use it, and what to expect.
Inputs58/100
2 of 3 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
enabled
Not provided
Missing description. Explain what this value means and how to supply it.
notifyStates
Stream states whose transitions notify
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
destinationIds
Replaces the destinations notified; ids from list_notification_destinations
The title clearly communicates the tool’s action and subject. Keep it concise.
Description99/100
Start here to ingest Google Cloud logs into Cotool Logs: Cloud Audit Logs, VPC flow, firewall, Cloud DNS, load balancer and Cloud Armor, GKE, Cloud Run, Compute Engine, or Security Command Center findings. Returns a setup script for the user's project with Cotool's identity filled in, the commands that turn on logging GCP leaves off, and who has to run them. The script creates a Pub/Sub subscription and a workload identity provider that trusts only Cotool, so no keys are shared. Ask which logs the user wants; recommend audit, then the network logs. After the script runs, pass the "subscription" and "workload_identity_provider" it prints to create_gcp_log_source. Rerunning a script fails on resources it already created; pass the same nameSuffix only to regenerate the same script, for example in the other setupFormat.
The description explains the capability, when to use it, and what to expect.
Inputs90/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
projectId
Project to create the Pub/Sub subscription and identity provider in, usually the one the logs come from
Clear enough to supply this argument.
logs
What to ingest. Cloud Logging entries, any mix in one source: audit (Cloud Audit Logs), vpc_flows (VPC flow logs), firewall (Firewall rule logs), dns (Cloud DNS queries), load_balancer (Load balancer and Cloud Armor), gke (GKE workloads), cloud_run (Cloud Run), compute (Compute Engine VMs). Or scc_findings (Security Command Center findings) on its own, since findings arrive by notification and need a source of their own.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
organizationId
Only with scc_findings: the numeric Google Cloud organization ID, to ingest findings from every project in the organization. Omit to ingest only the project's findings.
Clear enough to supply this argument.
setupFormat
gcloud CLI script, or Terraform configuration
Clear enough to supply this argument.
nameSuffix
Suffix of the resource names, from an earlier call. Omit for a new setup.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"logType",
"logTypeLabel",
"delivery",
"filter",
"turnOnLogging",
"setupFile",
"runAs",
"commands",
"outputs",
"nameSuffix",
"steps",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Opens the same setup in Cotool with these choices filled in"
},
"runAs": {
"type": "string",
"description": "Who has to run the setup"
},
"steps": {
"type": "array",
"items": {
"type": "string"
},
"description": "Markdown steps to send the user if you cannot run commands for them"
},
"filter": {
"type": "string",
"description": "Cloud Logging sink filter, or the finding notification filter"
},
"logType": {
"type": "string",
"description": "Log format the source will parse"
},
"outputs": {
"type": "string",
"description": "What to pass to create_gcp_log_source"
},
"commands": {
"type": "array",
"items": {
"type": "string"
},
"description": "Run in order from the directory holding setupFile"
},
"delivery": {
"enum": [
"log_sink",
"scc_notification"
],
"type": "string",
"description": "How entries reach the subscription"
},
"setupFile": {
"type": "object",
"required": [
"fileName",
"content"
],
"properties": {
"content": {
"type": "string"
},
"fileName": {
"type": "string"
}
},
"additionalProperties": false
},
"nameSuffix": {
"type": "string"
},
"logTypeLabel": {
"type": "string"
},
"turnOnLogging": {
"type": "array",
"items": {
"type": "object",
"required": [
"log",
"summary",
"command"
],
"properties": {
"log": {
"type": "string"
},
"command": {
"type": "string"
},
"summary": {
"type": "string"
}
},
"additionalProperties": false
},
"description": "Logging GCP leaves off by default. Fill the remaining <placeholders> with the user before running."
}
},
"additionalProperties": false
}
Original tool metadata
{
"name": "get_gcp_log_source_setup",
"title": "Get GCP log source setup",
"description": "Start here to ingest Google Cloud logs into Cotool Logs: Cloud Audit Logs, VPC flow, firewall, Cloud DNS, load balancer and Cloud Armor, GKE, Cloud Run, Compute Engine, or Security Command Center findings. Returns a setup script for the user's project with Cotool's identity filled in, the commands that turn on logging GCP leaves off, and who has to run them. The script creates a Pub/Sub subscription and a workload identity provider that trusts only Cotool, so no keys are shared. Ask which logs the user wants; recommend audit, then the network logs. After the script runs, pass the \"subscription\" and \"workload_identity_provider\" it prints to create_gcp_log_source. Rerunning a script fails on resources it already created; pass the same nameSuffix only to regenerate the same script, for example in the other setupFormat.",
"inputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"projectId",
"logs"
],
"properties": {
"logs": {
"type": "array",
"items": {
"enum": [
"scc_findings",
"audit",
"vpc_flows",
"firewall",
"dns",
"load_balancer",
"gke",
"cloud_run",
"compute"
],
"type": "string"
},
"maxItems": 9,
"minItems": 1,
"description": "What to ingest. Cloud Logging entries, any mix in one source: audit (Cloud Audit Logs), vpc_flows (VPC flow logs), firewall (Firewall rule logs), dns (Cloud DNS queries), load_balancer (Load balancer and Cloud Armor), gke (GKE workloads), cloud_run (Cloud Run), compute (Compute Engine VMs). Or scc_findings (Security Command Center findings) on its own, since findings arrive by notification and need a source of their own."
},
"projectId": {
"type": "string",
"pattern": "^[a-z][a-z0-9-]{4,28}[a-z0-9]$",
"description": "Project to create the Pub/Sub subscription and identity provider in, usually the one the logs come from"
},
"nameSuffix": {
"type": "string",
"pattern": "^[a-z0-9]{4,12}$",
"description": "Suffix of the resource names, from an earlier call. Omit for a new setup."
},
"setupFormat": {
"enum": [
"gcloud",
"terraform"
],
"type": "string",
"default": "gcloud",
"description": "gcloud CLI script, or Terraform configuration"
},
"organizationId": {
"type": "string",
"pattern": "^\\d{1,20}$",
"description": "Only with scc_findings: the numeric Google Cloud organization ID, to ingest findings from every project in the organization. Omit to ingest only the project's findings."
}
},
"additionalProperties": false
},
"outputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"logType",
"logTypeLabel",
"delivery",
"filter",
"turnOnLogging",
"setupFile",
"runAs",
"commands",
"outputs",
"nameSuffix",
"steps",
"url"
],
"properties": {
"url": {
"type": "string",
"description": "Opens the same setup in Cotool with these choices filled in"
},
"runAs": {
"type": "string",
"description": "Who has to run the setup"
},
"steps": {
"type": "array",
"items": {
"type": "string"
},
"description": "Markdown steps to send the user if you cannot run commands for them"
},
"filter": {
"type": "string",
"description": "Cloud Logging sink filter, or the finding notification filter"
},
"logType": {
"type": "string",
"description": "Log format the source will parse"
},
"outputs": {
"type": "string",
"description": "What to pass to create_gcp_log_source"
},
"commands": {
"type": "array",
"items": {
"type": "string"
},
"description": "Run in order from the directory holding setupFile"
},
"delivery": {
"enum": [
"log_sink",
"scc_notification"
],
"type": "string",
"description": "How entries reach the subscription"
},
"setupFile": {
"type": "object",
"required": [
"fileName",
"content"
],
"properties": {
"content": {
"type": "string"
},
"fileName": {
"type": "string"
}
},
"additionalProperties": false
},
"nameSuffix": {
"type": "string"
},
"logTypeLabel": {
"type": "string"
},
"turnOnLogging": {
"type": "array",
"items": {
"type": "object",
"required": [
"log",
"summary",
"command"
],
"properties": {
"log": {
"type": "string"
},
"command": {
"type": "string"
},
"summary": {
"type": "string"
}
},
"additionalProperties": false
},
"description": "Logging GCP leaves off by default. Fill the remaining <placeholders> with the user before running."
}
},
"additionalProperties": false
},
"annotations": {
"title": "Get GCP log source setup",
"readOnlyHint": true,
"openWorldHint": false,
"idempotentHint": true,
"destructiveHint": false
}
}
The title clearly communicates the tool’s action and subject. Keep it concise.
Description92/100
Connect the Pub/Sub subscription made by the get_gcp_log_source_setup script and start ingesting it into Cotool Logs. Cotool tests access first and only saves the source when the test passes. A failed test saves nothing and returns which check failed: IAM changes can take a few minutes to reach Google, so wait and call again with the same arguments before changing anything. Ask before calling.
The description explains the capability, when to use it, and what to expect.
Inputs79/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
subscription
"subscription" from the setup output
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
workloadIdentityProvider
"workload_identity_provider" from the setup output
Explain the meaning of this value, not just its name.
serviceAccountEmail
Only when the user granted the subscription to a service account Cotool's principal impersonates instead
Clear enough to supply this argument.
logs
The same logs passed to get_gcp_log_source_setup
Explain the meaning of this value, not just its name.
organizationId
Only with scc_findings: the numeric Google Cloud organization ID, to ingest findings from every project in the organization. Omit to ingest only the project's findings.
Clear enough to supply this argument.
name
Source name shown in Cotool. Defaults to the log type and project.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description98/100
Start here to send AWS logs in S3 to Cotool Logs: CloudTrail, GuardDuty findings, Security Hub findings, VPC flow logs, Application Load Balancer, CloudFront, WAF, S3 server access logs, Route 53 Resolver query logs, or other JSON logs. Each service is its own log source on its own bucket prefix. Returns an AWS CLI script that creates a dedicated SQS queue the buckets notify and an IAM role Cotool assumes with the organization's external ID, so no AWS keys are shared. Run it, then pass its outputs to create_aws_log_source.
The description explains the capability, when to use it, and what to expect.
Inputs63/100
3 of 4 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
logType
What the bucket holds: cloudtrail, guardduty, security_hub, vpc_flow_logs, alb_access_logs, cloudfront, waf, s3_access_logs, route53_resolver, or generic_json for any other JSON logs
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
buckets › items › bucket
Not provided
Missing description. Explain what this value means and how to supply it.
buckets › items › prefix
Key prefix Cotool may read. Leave it out for the service's suggested prefix, like guardduty/; pass an empty string for the whole bucket.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
kmsKeyArns
Customer-managed KMS keys that encrypt the objects. GuardDuty always needs one.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description88/100
Connect an AWS log source with the queue and role from get_aws_log_source_setup's script. Runs Cotool's access test first and saves nothing if a check fails or the objects look like another log type. Once saved and enabled, Cotool starts reading new objects into Cotool Logs. For a built-in service, the result has the commands that turn on its delivery to the bucket.
Describe the returned information so the agent knows whether it will answer the request.
Inputs83/100
8 of 9 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
logType
What the bucket holds: cloudtrail, guardduty, security_hub, vpc_flow_logs, alb_access_logs, cloudfront, waf, s3_access_logs, route53_resolver, or generic_json for any other JSON logs
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
buckets › items › bucket
Not provided
Missing description. Explain what this value means and how to supply it.
buckets › items › prefix
Key prefix Cotool may read. Leave it out for the service's suggested prefix, like guardduty/; pass an empty string for the whole bucket.
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
kmsKeyArns
Customer-managed KMS keys that encrypt the objects. GuardDuty always needs one.
Clear enough to supply this argument.
queueUrl
queue_url from the script, the dedicated SQS queue
Clear enough to supply this argument.
roleArn
role_arn from the script, the role Cotool assumes
Clear enough to supply this argument.
name
Source name; defaults to the log type
Clear enough to supply this argument.
enable
Start reading right away; false saves it paused
Clear enough to supply this argument.
keepLogType
Save with logType even though the test detected another type. Only when the user chose to.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description89/100
List the integrations Cotool can connect to (security tools, SaaS apps, and cloud CLIs) and whether each is connected. With includeActions, also list the actions agents can call, whose names go in create_agent toolNames.
The description explains the capability, when to use it, and what to expect.
Inputs50/100
2 of 3 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values.
query
Only integrations whose name or type contains this text
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
connected
Only connected (true) or unconnected (false) integrations
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
includeActions
Not provided
Missing description. Explain what this value means and how to supply it.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description96/100
Start here when the user wants to connect, reconnect, or fix an integration. Returns a wizard to follow and what the integration needs: a setup guide when one exists, setup instructions, the permissions to grant, and its connect form fields with their current values. Fields and instructions with onlyWhen apply only when that field has that value. Fields marked secret are never shown or accepted here. Never send secrets such as API keys, passwords, or private keys through chat; the user enters them in Cotool.
The description explains the capability, when to use it, and what to expect.
Inputs71/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
kind
"integration" for API integrations, "cli" for CLI integrations such as AWS and gcloud
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
type
Type from list_integrations
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
The title clearly communicates the tool’s action and subject. Keep it concise.
Description88/100
Fill in an integration's non-secret connect form fields, such as an AWS role ARN or a GCP project ID, and connect it when no secret is needed. Fields you leave out keep their current values. When the user still has to enter a secret or a required value, nothing is saved and you get a link and steps to send them; the link opens the form in Cotool with your values filled in. Never send secrets such as API keys, passwords, or private keys through chat; the user enters them in Cotool. If the user pastes a secret into the chat, do not pass it on: tell them it may be exposed and that they should rotate it.
The description explains the capability, when to use it, and what to expect.
Inputs75/100
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
kind
"integration" for API integrations, "cli" for CLI integrations such as AWS and gcloud
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
type
Type from list_integrations
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
fields
Non-secret field values keyed by field name from get_integration_setup
Remove validation rules already expressed in this field’s schema; describe its meaning and usage instead.
{
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"status",
"saved"
],
"properties": {
"name": {
"type": "string"
},
"saved": {
"type": "boolean"
},
"steps": {
"type": "array",
"items": {
"type": "string"
},
"description": "Markdown steps to send the user"
},
"status": {
"enum": [
"connected",
"user_action_required",
"no_credentials_needed"
],
"type": "string"
},
"message": {
"type": "string"
},
"setupUrl": {
"type": "string",
"description": "Link to open this in Cotool"
},
"fieldsForUser": {
"type": "array",
"items": {
"type": "string"
},
"description": "Fields the user still has to fill in"
},
"ifSignInFails": {
"type": "string"
}
},
"additionalProperties": false
}
Original tool metadata
{
"name": "configure_integration",
"title": "Configure integration",
"description": "Fill in an integration's non-secret connect form fields, such as an AWS role ARN or a GCP project ID, and connect it when no secret is needed. Fields you leave out keep their current values. When the user still has to enter a secret or a required value, nothing is saved and you get a link and steps to send them; the link opens the form in Cotool with your values filled in. Never send secrets such as API keys, passwords, or private keys through chat; the user enters them in Cotool. If the user pastes a secret into the chat, do not pass it on: tell them it may be exposed and that they should rotate it.",
"inputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"kind",
"type",
"fields"
],
"properties": {
"kind": {
"enum": [
"integration",
"cli"
],
"type": "string",
"description": "\"integration\" for API integrations, \"cli\" for CLI integrations such as AWS and gcloud"
},
"type": {
"type": "string",
"minLength": 1,
"description": "Type from list_integrations"
},
"fields": {
"type": "object",
"description": "Non-secret field values keyed by field name from get_integration_setup",
"additionalProperties": {
"type": "string"
}
}
},
"additionalProperties": false
},
"outputSchema": {
"type": "object",
"$schema": "http://json-schema.org/draft-07/schema#",
"required": [
"status",
"saved"
],
"properties": {
"name": {
"type": "string"
},
"saved": {
"type": "boolean"
},
"steps": {
"type": "array",
"items": {
"type": "string"
},
"description": "Markdown steps to send the user"
},
"status": {
"enum": [
"connected",
"user_action_required",
"no_credentials_needed"
],
"type": "string"
},
"message": {
"type": "string"
},
"setupUrl": {
"type": "string",
"description": "Link to open this in Cotool"
},
"fieldsForUser": {
"type": "array",
"items": {
"type": "string"
},
"description": "Fields the user still has to fill in"
},
"ifSignInFails": {
"type": "string"
}
},
"additionalProperties": false
},
"annotations": {
"title": "Configure integration",
"readOnlyHint": false,
"openWorldHint": true,
"idempotentHint": true,
"destructiveHint": false
}
}
Loading score analytics…
Put your MCP to the test
A few tasks worth trying with this server, chosen from its reviewed tools. These have not been run.
02Search threat intelSearch the threat intel feed (advisories and reports from the organization's intel sources), newest first, with each item's relevancy and exposure scores fro…
03Get alertGet an alert's full details, including its description, source, detection, and triage state.
04Search agentsSearch the organization's Cotool agents, most recently updated first; all of them when no filter is given.
05Search Cotool alerts, newest first
Want to run these tasks against your MCP server with us?
Cotool setup, tools, quality score, publishing readiness, and alternatives.
How do I add Cotool to Claude, ChatGPT, or Cursor?
Add Cotool to Claude, ChatGPT, or Cursor by connecting its remote MCP URL in each client's MCP settings. In Claude, add a custom connector. In ChatGPT, add an MCP app. In Cursor, add an MCP server under Settings. The MCP URL is https://informed-perfect-mudfish.ngrok-free.app/api/mcp.
Is Cotool MCP ready for ChatGPT and Claude?
As of November 6, 2026, Cotool scores 100/100 on Manufact's MCP publishing checklist. The scan meets ChatGPT publishing checks and meets Claude publishing checks. Passing these checks does not guarantee marketplace approval.
How clear is Cotool's MCP tool documentation?
As of November 6, 2026, Cotool scores 84/100 in Manufact's review of tool titles, descriptions, input and output schemas, and behavior annotations. The review covers 71 of 71 discovered tools. The quality score measures documentation clarity; runtime behavior and marketplace readiness require separate checks.
What are the best alternatives to Cotool?
As of November 7, 2026, alternatives to Cotool in developer-tools on the Manufact MCP leaderboard include Speko, Manufact, Context, AgentMail, and TPC Benchmarks.
How can Cotool improve its MCP documentation?
search_docs is the lowest-scoring reviewed tool at 66/100. 0 of 2 inputs have descriptions. Add descriptions to the missing inputs, including where to obtain IDs and how to supply values. Open its review for feedback and a copyable fix prompt, then rerun the documentation review after updating your tool metadata.
Not your MCP?
Review any public or OAuth MCP server for protocol compatibility, tool documentation, and ChatGPT and Claude publishing readiness. No account required.
Cursor
Grok Bot
Grok
Muse