Case and alert tools

The MCP tools that create, read, and update cases and add blocks and comments to them, and read and promote alerts.

The info tools read and write a case's own fields, the block tools read a case's blocks or append an analysis, log, note, or task block, and add-comment comments on a block. get-case-audit-logs returns the case's audit trail.

Tool names and schemas can change at any time

An agent sees each change the next time it reads tools/list, while a script that hard-codes a tool name or schema breaks when that tool changes.

Each section below is one tool as MCP access registers it: its title, its description, the annotations it sets, and the input and output schemas from tools/list. Field paths use parent.child for a nested object, parent[].child for the items of an array, and parent[Value].child for one variant of a field that takes several shapes.

get-alert

Get alert.

Retrieves full details for a single alert by ID, including priority, promotion threshold and budget snapshots, promoted case link, merge relationships, a bounded signal-evidence summary (total count, time span, per-detection timeline, and a deduplicated sample of representative signals), and recent audit logs (where router rationale and decision snapshots are recorded). Use list-alerts to discover alert IDs first.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
alertId	string	Required	Pattern: ^ALR_[A-Z0-9]{1,7}$.
maxSignalRows	integer	Optional	Minimum 1. Maximum 50. Defaults to 10.

Outputs

Field	Type	Description
alert	object
alert.id	string	Pattern: ^ALR_[A-Z0-9]{1,7}$.
alert.name	string
alert.status	enum	One of Queued, Accumulating, Processing, Promoted, Merged, Expired, TriageFailure.
alert.createdByDetectionId	string	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
alert.createdByDetectionName	string	May be null.
alert.currentPriority	integer	May be null. Minimum 1. Maximum 10.
alert.summary	string
alert.accumulationKeyValue	string	May be null.
alert.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
alert.spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
alert.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
alert.createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
alert.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
alert.updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
alert.version	number
alert.sourceViewName	string	May be null.
alert.totalSignalCount	integer	Minimum 0.
alert.promotionThresholdAtDecision	integer	May be null. Minimum 1. Maximum 10.
alert.budgetRemainingAtDecision	number	May be null.
alert.promotedCaseId	string	May be null. Pattern: ^CAS_[A-Z0-9]{1,7}$.
alert.mergedIntoAlertId	string	May be null. Pattern: ^ALR_[A-Z0-9]{1,7}$.
alert.mergedAlertIds	array of string
alert.auditLogs	array of object
alert.auditLogs[].id	integer	Greater than 0.
alert.auditLogs[].version	integer	Greater than 0.
alert.auditLogs[].timestamp	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
alert.auditLogs[].userId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
alert.auditLogs[].chatId	string	May be null. Pattern: ^CHT_[A-Z0-9]{1,7}$.
alert.auditLogs[].changes	object	Nested fields omitted; see the schema in tools/list.
alert.auditLogs[].addedRelationships	array of object	Nested fields omitted; see the schema in tools/list.
alert.auditLogs[].removedRelationships	array of object	Nested fields omitted; see the schema in tools/list.
alert.auditLogs[].reason	string	May be null. At most 4000 characters.
signalEvidence	object
signalEvidence.detections	array of object
signalEvidence.detections[].id	string
signalEvidence.detections[].name	string
signalEvidence.detections[].playbook	string
signalEvidence.signals	object
signalEvidence.signals.total	integer	Minimum 0.
signalEvidence.signals.span	object	Nested fields omitted; see the schema in tools/list.
signalEvidence.signals.timeline	array of object (two variants)	Nested fields omitted; see the schema in tools/list.
signalEvidence.signals.sample	array of object	Nested fields omitted; see the schema in tools/list.
signalEvidence.priorAssessment	object
signalEvidence.priorAssessment.priority	integer	Minimum 1. Maximum 10.
signalEvidence.priorAssessment.name	string
signalEvidence.priorAssessment.note	string
signalEvidence.priorAssessment.summary	string
signalEvidence.scoringMode	enum	One of first, rescore.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

list-alerts

List alerts.

Lists alerts in the triage queue. Use filter, orderby, top, and skip to narrow, sort, and page — each parameter documents the fields and syntax it accepts. Returns summary alert fields with a signal count (no signal id lists, snapshots, or audit logs), plus the total number of matches so you can tell a page from the whole set. Use this to discover alerts before calling get-alert for full details or promote-alert to create a case from an alert.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
filter	string	Optional
orderby	string	Optional
top	integer	Optional	Greater than 0. Maximum 200. Defaults to 100.
skip	integer	Optional	Minimum 0. Defaults to 0.
spaceIds	array of string	Optional

Outputs

Field	Type	Description
alerts	array of object
alerts[].id	string	Pattern: ^ALR_[A-Z0-9]{1,7}$.
alerts[].name	string
alerts[].status	enum	One of Queued, Accumulating, Processing, Promoted, Merged, Expired, TriageFailure.
alerts[].createdByDetectionId	string	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
alerts[].createdByDetectionName	string	May be null.
alerts[].currentPriority	integer	May be null. Minimum 1. Maximum 10.
alerts[].summary	string
alerts[].accumulationKeyValue	string	May be null.
alerts[].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
alerts[].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
alerts[].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
alerts[].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
alerts[].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
alerts[].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
alerts[].version	number
alerts[].signalCount	integer	Minimum 0.
totalCount	integer	Minimum 0.
skip	integer	Minimum 0.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

promote-alert

Promote alert.

Promotes a queued, triage-failure, or expired alert to a new case using the alert's stored primary-signal snapshot. Set promoteWithoutInvestigation explicitly: when false, Simba runs automated case investigation and bills the space's triage budget; when true, the case is created without that LLM analysis.

Requires the active chat's space to match the alert's space. The user must approve the exact call.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint true.

Inputs

Field	Type	Required	Description
alertId	string	Required	Pattern: ^ALR_[A-Z0-9]{1,7}$.
promoteWithoutInvestigation	boolean	Required	When true, create the case without running Simba's automated investigation (no LLM spend against the space's triage budget). When false, the investigation runs.
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
caseId	string	Pattern: ^CAS_[A-Z0-9]{1,7}$.
created	boolean	False when the alert was already promoted or its signal already belonged to a case; caseId then points at the existing case.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

create-case

Create case.

Creates a new case. All fields are optional - provide name, type, severity, phase, priority, assignment, and summary as needed.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Optional	Must not be empty.
assignedToUserId	string	Optional	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
summary	string	Optional
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.
logBlocks	array of object	Optional
logBlocks[].columns	array of object	Required
logBlocks[].columns[].name	string	Required
logBlocks[].columns[].type	object (seven variants)	Required	Or one of binary, boolean, interval, calendar_interval, int, double, rows, string, timestamp, unknown, variant. Nested fields omitted; see the schema in tools/list.
logBlocks[].rows	array of array of unknown	Required
noteBlocks	array of object	Optional
noteBlocks[].text	string	Required
typeName	string	Optional
severityName	string	Optional
phaseName	string	Optional

Outputs

Field	Type	Description
caseId	string	The ID of the created case.
errors	array of object
errors[].message	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

list-cases

List cases.

Lists cases. Use filter, orderby, top, and skip to narrow, sort, and page — each parameter documents the fields and syntax it accepts. Returns main case fields without blocks, plus the total number of matches so you can tell a page from the whole set. Use this to discover cases before calling get-case-info, get-case-blocks, or other case tools.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
filter	string	Optional
orderby	string	Optional
top	integer	Optional	Greater than 0. Maximum 200. Defaults to 100.
skip	integer	Optional	Minimum 0. Defaults to 0.
spaceIds	array of string	Optional

Outputs

Field	Type	Description
cases	array of object
cases[].id	string	Pattern: ^CAS_[A-Z0-9]{1,7}$.
cases[].name	string	Must not be empty.
cases[].status	enum	One of Open, On-Hold, Closed.
cases[].closureCode	enum	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
cases[].suggestedClosureCode	enum	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
cases[].suggestedClosureCodeDismissed	boolean
cases[].typeId	integer	May be null. Greater than 0.
cases[].severityId	integer	May be null. Greater than 0.
cases[].phaseId	integer	Greater than 0.
cases[].assignedToUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
cases[].summary	string
cases[].entities	array of object
cases[].entities[].type	enum	One of ip_address, hostname, email, domain, username, file_hash, url.
cases[].entities[].value	string
cases[].entities[].normalizedValue	string
cases[].createdByDetectionId	string	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
cases[].organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
cases[].spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
cases[].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
cases[].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
cases[].updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
cases[].updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
cases[].version	number
cases[].timeToDetectMs	integer	May be null. Minimum 0.
cases[].timeToInvestigateMs	integer	May be null. Minimum 0.
cases[].timeToContainMs	integer	May be null. Minimum 0.
cases[].timeToEradicateMs	integer	May be null. Minimum 0.
cases[].timeToResolveMs	integer	May be null. Minimum 0.
cases[].initialAnalysisStatus	enum	One of PENDING, IN_PROGRESS, PARTIAL, COMPLETED, FAILED, SKIPPED, STOPPED.
cases[].initialAnalysisCompletedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
cases[].closedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
cases[].closedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
cases[].closedByChatId	string	May be null. Pattern: ^CHT_[A-Z0-9]{1,7}$.
cases[].analysisSkippedReason	enum	One of QuotaExceeded, BudgetExhausted, PromoteAllConfigured, UserRequested, RateLimited, AutomaticAnalysisDisabled. May be null.
cases[].analysisStoppedReason	enum	One of QuotaExceeded. May be null.
totalCount	integer	Minimum 0.
skip	integer	Minimum 0.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

get-case-info

Get case info.

Retrieves the top-level properties of a specific case by ID, including name, status, priority, severity, summary, and assignments.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
caseId	string	Required	The ID of the case to retrieve.

Outputs

Field	Type	Description
case	object
case.id	string	Pattern: ^CAS_[A-Z0-9]{1,7}$.
case.name	string	Must not be empty.
case.status	enum	One of Open, On-Hold, Closed.
case.closureCode	enum	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
case.suggestedClosureCode	enum	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
case.suggestedClosureCodeDismissed	boolean
case.typeId	integer	May be null. Greater than 0.
case.severityId	integer	May be null. Greater than 0.
case.phaseId	integer	Greater than 0.
case.assignedToUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
case.summary	string
case.entities	array of object
case.entities[].type	enum	One of ip_address, hostname, email, domain, username, file_hash, url.
case.entities[].value	string
case.entities[].normalizedValue	string
case.createdByDetectionId	string	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
case.organizationId	string	Pattern: ^ORG_[A-Z0-9]{1,7}$.
case.spaceId	string	Pattern: ^SPC_[A-Z0-9]{1,7}$.
case.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
case.createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
case.updatedAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
case.updatedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
case.version	number
case.timeToDetectMs	integer	May be null. Minimum 0.
case.timeToInvestigateMs	integer	May be null. Minimum 0.
case.timeToContainMs	integer	May be null. Minimum 0.
case.timeToEradicateMs	integer	May be null. Minimum 0.
case.timeToResolveMs	integer	May be null. Minimum 0.
case.initialAnalysisStatus	enum	One of PENDING, IN_PROGRESS, PARTIAL, COMPLETED, FAILED, SKIPPED, STOPPED.
case.initialAnalysisCompletedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
case.closedAt	string	JavaScript Date or other runtime timestamp in tool results. May be null. Format: date-time. Constrained by a pattern; see the schema in tools/list.
case.closedByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
case.closedByChatId	string	May be null. Pattern: ^CHT_[A-Z0-9]{1,7}$.
case.analysisSkippedReason	enum	One of QuotaExceeded, BudgetExhausted, PromoteAllConfigured, UserRequested, RateLimited, AutomaticAnalysisDisabled. May be null.
case.analysisStoppedReason	enum	One of QuotaExceeded. May be null.
case.typeName	string	The name of the case type.
case.severityName	string	The name of the case severity.
case.phaseName	string	The name of the case phase.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

update-case-info

Update case info.

Updates case information such as name, status, summary, assigned user, severity, type, phase, priority, and closure code. All fields are optional - only the fields you provide will be updated.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Optional	Must not be empty.
status	enum	Optional	One of Open, On-Hold, Closed.
closureCode	enum	Optional	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
assignedToUserId	string	Optional	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
summary	string	Optional
entities	array of object	Optional
entities[].type	enum	Required	One of ip_address, hostname, email, domain, username, file_hash, url.
entities[].value	string	Required
entities[].normalizedValue	string	Required
suggestedClosureCodeDismissed	boolean	Optional
caseId	string	Required	The ID of the case to update.
typeName	string	Optional
severityName	string	Optional
phaseName	string	Optional
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
caseId	string	The ID of the updated case.
errors	array of object
errors[].message	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

get-case-blocks

Get case blocks.

Retrieves all blocks for a specific case, including note blocks, log blocks, task blocks, and analysis blocks. Each block includes its comments. When helping the user work on a case, you should always use this tool, because this is the only way to get the full context of the case.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
caseId	string	Required	The ID of the case to retrieve blocks for.

Outputs

Field	Type	Description
blocks	array of object (one variants)
blocks[][CaseAlertBlock].id	string
blocks[][CaseAlertBlock].comments	array of object
blocks[][CaseAlertBlock].comments[].id	string	Comment resource ID (COM_*).
blocks[][CaseAlertBlock].comments[].createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
blocks[][CaseAlertBlock].comments[].createdByUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
blocks[][CaseAlertBlock].comments[].text	string
blocks[][CaseAlertBlock].resourceKind	string	Always CaseAlertBlock.
blocks[][CaseAlertBlock].operation	enum	One of Promotion, Merge.
blocks[][CaseAlertBlock].primaryAlertId	string	Pattern: ^ALR_[A-Z0-9]{1,7}$.
blocks[][CaseAlertBlock].mergedAlertCount	integer	Minimum 0.
blocks[][CaseAlertBlock].unavailableAlertCount	integer	Minimum 0.
blocks[][CaseAlertBlock].primaryAlert	object
blocks[][CaseAlertBlock].primaryAlert.id	string	Pattern: ^ALR_[A-Z0-9]{1,7}$.
blocks[][CaseAlertBlock].primaryAlert.name	string
blocks[][CaseAlertBlock].primaryAlert.status	enum	One of Queued, Accumulating, Processing, Promoted, Merged, Expired, TriageFailure.
blocks[][CaseAlertBlock].primaryAlert.currentPriority	integer	May be null. Minimum 1. Maximum 10.
blocks[][CaseAlertBlock].primaryAlert.summary	string
blocks[][CaseAlertBlock].primaryAlert.createdByDetectionId	string	May be null. Pattern: ^DET_[A-Z0-9]{1,7}$.
blocks[][CaseAlertBlock].primaryAlert.createdByDetectionName	string	May be null.
blocks[][CaseAlertBlock].primaryAlert.sourceViewName	string	May be null.
blocks[][CaseAlertBlock].primaryAlert.playbookSnapshot	string	May be null.
blocks[][CaseAlertBlock].primaryAlert.createdAt	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
blocks[][CaseAlertBlock].evidence	object
blocks[][CaseAlertBlock].evidence.signals	object	Nested fields omitted; see the schema in tools/list.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

get-case-audit-logs

Get case audit logs.

Retrieves the complete audit log history for a case, showing all changes made over time including who made them and when.

Annotations: readOnlyHint true, idempotentHint true.

Inputs

Field	Type	Required	Description
caseId	string	Required	The ID of the case to retrieve audit logs for.

Outputs

Field	Type	Description
auditLogs	array of object
auditLogs[].id	integer	Greater than 0.
auditLogs[].version	integer	Greater than 0.
auditLogs[].timestamp	string	JavaScript Date or other runtime timestamp in tool results. Format: date-time. Constrained by a pattern; see the schema in tools/list.
auditLogs[].userId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
auditLogs[].chatId	string	May be null. Pattern: ^CHT_[A-Z0-9]{1,7}$.
auditLogs[].changes	object
auditLogs[].changes.name	string	Must not be empty.
auditLogs[].changes.status	enum	One of Open, On-Hold, Closed.
auditLogs[].changes.closureCode	enum	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
auditLogs[].changes.typeId	integer	May be null. Greater than 0.
auditLogs[].changes.severityId	integer	May be null. Greater than 0.
auditLogs[].changes.phaseId	integer	Greater than 0.
auditLogs[].changes.assignedToUserId	string	May be null. Pattern: ^USR_[A-Z0-9]{1,7}$.
auditLogs[].changes.summary	string
auditLogs[].changes.suggestedClosureCodeDismissed	boolean
auditLogs[].changes.entities	object (one variants)	Or an array of object. Nested fields omitted; see the schema in tools/list.
auditLogs[].changes.suggestedClosureCode	enum	One of True Positive - Suspicious Activity, Benign Positive - Suspicious But Expected, False Positive - Incorrect Detection Logic, False Positive - Inaccurate Data, Other, Testing. May be null.
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

add-comment

Add comment to block.

Adds a comment to a block. Comments allow discussion and annotation on specific blocks within a case.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
blockId	string	Required	The ID of the block to add the comment to.
text	string	Required	The text content of the comment.
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
commentId	string	The ID of the created comment.
errors	array of object
errors[].message	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

add-analysis-block

Add analysis block.

Creates a follow-up analysis task block for a case. Use this to delegate complex investigation or analysis work to an AI agent with specific instructions.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
caseId	string	Required	The ID of the case.
name	string	Required	A short question that describes what should be investigated (e.g., 'Did the attacker gain access to the production systems?', 'Was there any other malicious activity from this IP address?'). Keep it under 20 words.
additionalInstructions	string	Required	Detailed instructions for the analysis agent to execute.
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
blockId	string	ID of the created analysis block.
errors	array of object
errors[].message	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

add-log-block

Add log block to case.

Adds a log block to a case. Log blocks contain arrays of log entries related to the investigation.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
caseId	string	Required	The ID of the case to add the log block to.
columns	array of object	Required
columns[].name	string	Required
columns[].type	object (seven variants)	Required	Or one of binary, boolean, interval, calendar_interval, int, double, rows, string, timestamp, unknown, variant.
columns[].type[variant 1].decimal	object	Required	Nested fields omitted; see the schema in tools/list.
columns[].type[variant 2].array	object	Required	Nested fields omitted; see the schema in tools/list.
columns[].type[variant 3].map	object	Required	Nested fields omitted; see the schema in tools/list.
columns[].type[variant 4].tuple	object	Required	Nested fields omitted; see the schema in tools/list.
columns[].type[variant 5].range	object	Required	Nested fields omitted; see the schema in tools/list.
columns[].type[variant 6].range_inclusive	object	Required	Nested fields omitted; see the schema in tools/list.
columns[].type[variant 7].struct	array of object	Required	Nested fields omitted; see the schema in tools/list.
rows	array of array of unknown	Required
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
blockId	string	The ID of the created log block.
errors	array of object
errors[].message	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

add-note-block

Add note block to case.

Adds a text note block to a case. Note blocks contain text descriptions, findings, or analyst commentary. Use this tool only when the user explicitly asks to add content to the case. Do not use it to present content in chat, even when the content comes from or relates to the case.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
caseId	string	Required	The ID of the case to add the note to.
text	string	Required	The text content of the note.
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
blockId	string	The ID of the created note block.
errors	array of object
errors[].message	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

add-task-block

Add task block.

Creates a recommended response action (task) for a case. Use this to document actions that should be taken based on analysis findings.

Annotations: readOnlyHint false, destructiveHint false, idempotentHint false.

Inputs

Field	Type	Required	Description
name	string	Required	Must not be empty.
description	string	Required
assignedToUserId	string	Optional	Pattern: ^USR_[A-Z0-9]{1,7}$.
status	enum	Optional	One of PENDING, COMPLETED, DISMISSED.
caseId	string	Required	The ID of the case.
spaceId	string	Required	The ID of the space to target for this operation. Pattern: ^SPC_[A-Z0-9]{1,7}$.

Outputs

Field	Type	Description
blockId	string	ID of the created task block.
errors	array of object
errors[].message	string
links	array of object (three variants)
links[][resource].type	string	Always resource.
links[][resource].id	string
links[][resource].resourceKind	enum	One of CaseAlertBlock, Alert, AiProvider, Case, CaseAnalysisBlock, CaseLogBlock, CaseNoteBlock, CaseResponseActionBlock, Changeset, Chat, Comment, Connector, ContentPack, ContentPackInstallation, ContentWorkItem, Credential, Dashboard, DataPlane, Detection, Folder, HttpToolConfig, Integration, Lookup, Mapper, McpConfig, Organization, Parser, ResourceGroup, Role, Schema, Skill, Space, Table, ThreatReport, Union, User, View, WebhookConfig.
links[][resource].link	string	Canonical URL for this result. Format: uri.
links[][changeset].type	string	Always changeset.
links[][changeset].id	string
links[][changeset].link	string	Canonical URL for this result. Format: uri.
links[][query].type	string	Always query.
links[][query].id	string
links[][query].link	string	Canonical URL for this result. Format: uri.

Related

• MCP access, the surface these tools are registered on.
• Cases, the resource.