Crowdsentinel MCP Server

Decode an obfuscated/encoded command line and recover the IoCs + ATT&CK techniques it conceals. Encoded payloads (e.g. `powershell -EncodedCommand <base64>`) hide their C2 IP/URL from plaintext hunting and from analyze_search_results — this tool peels the encoding (stdlib base64/UTF-16LE/gzip/hex; optional `chepy` for the long tail) so the hidden indicators become visible. Returns: - decoded: whether any layer decoded - recipe: ordered decode steps (e.g. ["base64→utf-16le"]) for the IR report - layers: each decoded layer's recipe + text - iocs: IPs/URLs recovered from the deco…

Force protocol interpretation on non-standard ports. Useful when services run on non-standard ports and need to be decoded as a specific protocol. Args: pcap_path: Path to PCAP file port: Port number to decode protocol: Protocol to decode as (http, https, dns, etc.) Returns: Decoded traffic summary Example: decode_traffic("/path/to/capture.pcap", port=8080, protocol="http")

Delete an alias for a specific index. Args: index: Name of the index name: Name of the alias

Deletes documents matching the provided query. Args: index: Name of the index body: Query to match documents for deletion

Delete one or more data streams. Permanently deletes the specified data streams and all their backing indices. Args: name: Name of the data stream(s) to delete. Can be a comma-separated list or wildcard pattern.

Delete a document by ID. Args: index: Name of the index id: Document ID

Delete an index. Args: index: Name of the index

Detect C2 beaconing patterns based on connection timing analysis. Identifies hosts that communicate at regular intervals, which is characteristic of command-and-control malware. Args: pcap_path: Path to PCAP file min_connections: Minimum connections to analyze (default: 10) max_jitter_percent: Maximum jitter percentage for beacon detection (default: 15%) Returns: Dictionary with beacon patterns and ASCII timeline visualization Example: detect_beaconing("/path/to/suspicious.pcap")

Detect lateral movement patterns in network traffic. Identifies SMB, RDP, WinRM, and other protocols commonly used for lateral movement within a network. Args: pcap_path: Path to PCAP file internal_only: Only flag internal-to-internal connections (default: True) Returns: Dictionary with lateral movement findings and risk scores Example: detect_lateral_movement("/path/to/internal_traffic.pcap")

Detect which schema to use for an index pattern. Attempts to match the index pattern against known schema patterns. Use this to understand which schema will be auto-detected for a query. Args: index_pattern: The Elasticsearch index pattern (e.g., "winlogbeat-*") Returns: Detected schema information or available options if no match Examples: detect_schema_for_index("winlogbeat-*") detect_schema_for_index("logs-endpoint.events.process-*")

Discover all assets in the Elasticsearch cluster including indices, data streams, and their metadata. This will scan all indices and extract metadata like OS type, log source, field mappings, etc. The discovered assets are saved to assets/discovered_assets.json and can be used for incident response and threat hunting. Returns: Dictionary containing all discovered assets with metadata

Discover available indices for ES|QL hunting. Use this to find indices compatible with your hunting queries, especially when the default index patterns (e.g., logs-endpoint.*) don't exist in your environment. Args: fields: List of field names to search for (e.g., ["process.name", "user.name"]) If not provided, shows all non-empty indices data_type: Optional hint for data type (windows, linux, network) Returns: Dictionary containing: - indices: List of matching indices with doc counts and match scores - total_indices: Total number of non-empty indices - fi…

Pivot an Elastic IoC into a targeted Velociraptor hunt (Elastic -> endpoint). Takes one SIEM IoC and runs the matching Velociraptor artefact on the endpoint, capturing any matches to the ACTIVE investigation (call create_investigation first). Args: ioc_value: The IoC value (hash, process name, IP, or file path). ioc_type: One of 'hash', 'process', 'ip', 'file_path'. client_id: Velociraptor client ID (C.xxxx). Required — a specific endpoint must be named (fleet-wide hunt is not supported here). Returns: Endpoint matches for the IoC, captured to the active investigatio…

Collect an endpoint artifact, extract IoCs, then search SIEM for those IoCs across all hosts. This is the reverse of correlate_siem_with_endpoint — it starts from endpoint forensics and pivots to SIEM to find the same indicators on other machines (lateral movement detection). The endpoint-origin IoCs are persisted to the ACTIVE investigation (call create_investigation first). With auto_search=True (and the server-provided SearchClient), it also searches Elastic for each IoC and persists the matches, so a hash seen on the endpoint and in the SIEM merges into a single IoC carrying both VELOCIRA…

Enrich IoCs from the active investigation with external threat intelligence. Queries configured providers (Shodan, AbuseIPDB, VirusTotal, ThreatFox) and updates each IoC with verdict (malicious/clean/unknown), confidence score, and enrichment context. Shodan InternetDB works without any API key. Other providers require environment variables (VIRUSTOTAL_API_KEY, ABUSEIPDB_API_KEY, THREATFOX_API_KEY). Note: VirusTotal free tier allows 4 requests/minute. Enriching many IoCs with VT enabled may take several minutes (15s delay per lookup). Args: investigation_id: Target investigation (defau…

Delete an async EQL search by ID. Args: eql_search_id: The ID of the EQL search to delete Returns: Deletion acknowledgement

Get the status of an async EQL search. Args: eql_search_id: The ID of the EQL search Returns: Status information for the EQL search

Execute an EQL (Event Query Language) query for advanced threat hunting. EQL is designed for event-based data and is excellent for detecting attack patterns and sequences. Args: index: Index pattern to search (e.g., "winlogbeat-*") query: EQL query string (e.g., 'process where process.name == "regsvr32.exe"') size: Maximum number of results to return (default: 100) filter_query: Optional Elasticsearch filter to apply before EQL query timestamp_field: Timestamp field name (default: "@timestamp") Returns: EQL query results with matching events Examples: 1. Find sus…

Execute a raw ES|QL query for ad-hoc threat hunting. ES|QL is Elasticsearch's piped query language (8.11+) designed for data exploration with aggregations, transformations, and enrichment. Args: query: The ES|QL query string (must start with FROM) auto_discover: If True and index not found, auto-discover compatible indices lean: If True, return token-efficient summarized results Returns: Dictionary containing: - hits_count: Number of results - tokens_used: Estimated token count - execution_time_ms: Query execution time - columns: Column names from result …

Execute a specific detection rule against Elasticsearch. This tool runs a detection rule and returns matching events. Args: rule_id: The unique rule identifier (from list_detection_rules) index: Index pattern to search (e.g., "winlogbeat-*", "auditbeat-*") timeframe_minutes: Time window in minutes (default: 15, use 0 for no time filter) size: Maximum number of results to return (default: 100, max: 1000) Returns: Dictionary containing: - rule_info: Rule metadata - total_hits: Number of matching events - events: List of matching events - execution_time_ms: …

Execute a curated ES|QL hunting query from the rule library. ES|QL queries run directly against Elasticsearch (requires 8.11+). **Adaptive Index Resolution:** - If `index` is provided, uses that index directly - If not provided, tries the rule's default index first - If default index not found, auto-discovers compatible indices based on query field requirements and executes against the best match Args: rule_id: The unique rule identifier (UUID from list_esql_hunts) index: Override index pattern (e.g., "winlogbeat-*", "logs-*") If not provided, uses adaptive index discov…

Execute multiple detection rules in batch. This tool runs multiple rules and aggregates the results, useful for comprehensive threat hunting campaigns. Args: rule_ids: List of rule IDs to execute index: Index pattern to search timeframe_minutes: Time window in minutes (default: 15) max_results_per_rule: Maximum results per rule (default: 50, max: 200) Returns: Dictionary with results for each rule and summary statistics Example: execute_multiple_rules( rule_ids=[ "windows_powershell_posh_ps_potential_invoke_mimikatz_eql", "windows_pro…

Export IoCs from an investigation in various formats. Exports collected IoCs for use in other security tools, threat intelligence platforms, or reporting. Args: format: Export format - "json", "csv", "values", or "stix" ioc_types: Filter by IoC types (e.g., ["ip", "domain"]) min_priority: Minimum priority to include (1-6) investigation_id: Specific investigation (uses active if not specified) Returns: Exported IoCs in the specified format Formats: - json: Full IoC details as JSON - csv: Comma-separated values - values: Plain list of values (one per line) …

Export investigation IoCs as a MISP event. Always produces a MISP JSON event (offline, no server needed). If push=True and MISP_URL + MISP_API_KEY are configured, also pushes the event to the live MISP instance. IoCs with an explicit clean verdict (is_malicious=False) are always excluded. Use source_filter to scope to the current hunt's IoCs and avoid exporting benign live-host enumeration noise (e.g. VR autoruns). Args: investigation_id: Target investigation (defaults to active) min_priority: Minimum Pyramid of Pain priority (default: 2) push: Whether to push to a live MISP ins…

Extract transferred objects (files) from network traffic. Carves out HTTP, SMB, and other protocol objects with SHA256 hashes. By default, only extracts metadata and hashes for safety. Args: pcap_path: Path to PCAP file protocol: Protocol to extract from (http, smb, tftp) store_files: Whether to save extracted files (default: False, metadata only) Returns: Dictionary with extracted objects, hashes, and metadata Example: extract_objects("/path/to/capture.pcap", protocol="http")

Perform a general HTTP API request. Use this tool for any Elasticsearch/OpenSearch API that does not have a dedicated tool. Args: method: HTTP method (GET, POST, PUT, DELETE, etc.) path: API endpoint path params: Query parameters body: Request body

Generate a comprehensive investigation report from multiple analyses. This tool aggregates results from multiple queries and analyses to create a complete incident response report. Args: analysis_results: List of analysis results from analyze_search_results tool investigation_context: Overall context of the investigation (e.g., "Suspected ransomware on finance department workstations") investigation_id: Optional. When given, the investigation's timeline is merged into the report and affected hosts/users are augmented from it. Returns: Comprehensive investigati…

Generate structured IoC artifacts from PCAP analysis. Extracts and structures indicators found during analysis for use in threat intelligence and detection systems. Args: pcap_path: Path to PCAP file min_confidence: Minimum confidence level for IoCs (1-10) Returns: Dictionary with IoCs structured for export Example: generate_iocs("/path/to/analyzed.pcap", min_confidence=7)

Generate an NCSC-style incident report from analysis findings. Creates a structured markdown report following the IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER framework. Args: pcap_path: Path to analyzed PCAP file findings: Optional pre-computed findings (if not provided, runs analysis) investigation_id: Optional investigation identifier Returns: Dictionary with the generated report Example: generate_report("/path/to/analyzed.pcap", investigation_id="INV-2024-001")

Get alias information for a specific index. Args: index: Name of the index

Returns basic information about the health of the cluster.

Returns high-level overview of cluster statistics.

Get information about one or more data streams. Retrieves configuration, mappings, settings, and other information about the specified data streams. Args: name: Name of the data stream(s) to retrieve. Can be a comma-separated list or wildcard pattern. If not provided, retrieves all data streams.

Get the Diamond Model of Intrusion Analysis guide. Returns complete information about the Diamond Model and how to use it for comprehensive threat analysis during hunting operations. Returns: Complete Diamond Model framework with: - All 4 vertices (Adversary, Capability, Infrastructure, Victim) - How to populate each vertex from hunt results - Integration with Pyramid of Pain - Example analysis Use this to: - Understand the complete attack picture - Connect different pieces of evidence - Identify gaps in your analysis

Get a document by ID. Args: index: Name of the index id: Document ID

Check which threat intelligence providers are configured. Reports API key status for each provider and recommends which keys to set for better coverage. Returns: Provider configuration status and recommendations

Get ES|QL query execution history for token usage analysis. Returns recent query executions with their token counts, hit counts, and execution times. Useful for optimizing query efficiency. Returns: Dictionary containing: - executions: List of recent executions with metrics - summary: Aggregate statistics Example: get_esql_execution_history()

Get detailed information about a specific ES|QL hunting rule. Args: rule_id: The unique rule identifier (UUID from list_esql_hunts) Returns: Dictionary with complete rule details including queries and notes Example: get_esql_hunt_details("2e583d3c-7ad6-4544-a0db-c685b2066493")

Get all fields available for a specific event type. Returns the complete field mapping for an event type, showing semantic names and their actual field paths. Args: event_type: The event type (e.g., "process_create", "network_connection") schema_id: Optional schema ID (shows all schemas if not specified) Returns: Field mappings for the event type across schemas Examples: # Get fields for specific schema get_event_type_fields("process_create", schema_id="sysmon") # Compare across all schemas get_event_type_fields("process_create")

Get the actual field name for a semantic field concept. Translates semantic field names (like "source_process") to the actual field path used in a specific schema (like "winlog.event_data.Image"). Args: semantic_field: The semantic field name (e.g., "source_process", "destination_ip", "command_line") event_type: The event type context (e.g., "process_create", "network_connection", "file_create") schema_id: Optional explicit schema ID. If not provided, tries to detect from index pattern index: Optional index pattern for auto-detection Returns: The …

Get a complete timeline of all activity for a specific host. This is essential for forensic analysis and incident investigation. Args: index: Index pattern (e.g., "winlogbeat-*") hostname: Hostname to investigate start_time: Start time (e.g., "now-1h", "2024-01-01T00:00:00") end_time: End time (optional, defaults to "now") Returns: Timeline of events sorted chronologically with event details Use case: Perform forensic timeline analysis to understand the full scope of a compromise on a specific host. Shows logons, process creation, network connections, and oth…

Returns information (mappings, settings, aliases) about one or more indices. Args: index: Name of the index

Get metadata for a specific index pattern. Args: index_pattern: Index name or pattern Returns: Dictionary containing index metadata (OS type, log source, fields, etc.) Example: get_index_metadata("winlogbeat-*") returns metadata about Windows event logs

Get indices matching a specific log type. Args: log_type: Type of logs to search for (windows, linux, sysmon, security, etc.) Returns: List of matching index names Examples: - "windows" - Returns all Windows indices - "linux" - Returns all Linux indices - "sysmon" - Returns all Sysmon indices - "security" - Returns all security log indices

Get the Elasticsearch query for an investigation prompt. This tool shows you the actual query that will be executed, along with the log sources and fields to check. Useful for: - Understanding what the prompt is looking for - Customizing queries for your environment - Verifying log source availability Args: prompt_id: Investigation prompt ID Returns: Query template and metadata Example: get_investigation_query("windows_logon_1")

Get a comprehensive summary of an investigation. This provides an overview of all collected IoCs, timeline events, findings from different tools, and investigation statistics. Args: format: Output format - "detailed", "compact", or "json" investigation_id: Specific investigation ID (uses active if not specified) Returns: Investigation summary with IoCs, timeline, and statistics Example: get_investigation_summary(format="compact")

Get the mandatory investigation workflow for CrowdSentinel. Call this tool at the START of any investigation to understand the required workflow phases and tools. The workflow ensures comprehensive analysis by requiring: 1. Data collection using hunting/search tools 2. Analysis using analyze_search_results and analyze_kill_chain_stage 3. Reporting using generate_investigation_report Returns: Complete workflow documentation with tool recommendations Example: # First thing to do when starting an investigation workflow = get_investigation_workflow() # Follow the phases describ…

Get a complete overview of the Cyber Kill Chain framework. This tool provides comprehensive information about all 7 stages of the Lockheed Martin Cyber Kill Chain, including what to look for at each stage and how many hunting queries are available. Returns: Complete kill chain overview including: - Framework description - All 7 stages with descriptions - Indicators for each stage - Typical IoCs for each stage - Log sources to check - MITRE ATT&CK tactic mappings - Number of hunting queries available per stage Use cases: - Understanding the kill chain fram…

Get the recommended next step after using a specific tool. Call this after any search/hunting tool to know what analysis tool to use next. Args: tool_name: The name of the tool you just used (e.g., "smart_search") Returns: Recommended next tool and explanation Example: # After running smart_search next_action = get_next_step("smart_search") # Returns: {"next_step": "analyze_search_results", "hint": "..."}

Get progressive disclosure prompt for session start. This provides a summary of recent investigations and shared IoCs to help resume work efficiently at the start of a new session. Returns: Dictionary with: - prompt: Human-readable summary for context - recent_investigations: List of recent investigations - shared_iocs_count: Number of shared IoCs available - storage_stats: Current storage usage Use at session start to understand available context. Example: get_progressive_disclosure()

Get the Pyramid of Pain framework guide for IoC prioritization. Returns complete information about the Pyramid of Pain levels and how to use them for effective threat hunting, starting with easy-to-track indicators and moving to harder-to-change TTPs. Returns: Complete Pyramid of Pain framework with: - All 6 levels with descriptions - Hunting strategy recommendations - Examples for each level - Integration with Diamond Model Use this to understand: - Which IoCs to hunt first - How attackers adapt to detection - Most effective hunting strategies

Get detailed information about a specific detection rule. Args: rule_id: The unique rule identifier Returns: Dictionary with complete rule details including query Example: get_rule_details("windows_powershell_posh_ps_potential_invoke_mimikatz_eql")

Get comprehensive statistics about the detection rule library. Returns: Dictionary with statistics about loaded rules Example: get_rule_statistics()

Retrieve previously discovered assets from the saved file. Returns: Dictionary containing saved asset information or empty if not found

Get detailed information about a specific schema. Args: schema_id: The schema identifier ("sysmon", "ecs", "windows_security") Returns: Complete schema details including all event types and field mappings Example: get_schema_details("sysmon")

Get IoCs shared across investigations and tools. This retrieves IoCs collected from all sources (Elasticsearch, Chainsaw, Wireshark) that can be used for cross-tool correlation and hunting. Args: ioc_types: Filter by IoC types (e.g., ["ip", "domain", "hash"]) min_priority: Minimum Pyramid of Pain priority (1-6, higher = more valuable) sources: Filter by source tools (e.g., ["elasticsearch", "chainsaw"]) active_only: Only from active investigation limit: Maximum IoCs to return (default: 100) Returns: Dictionary with: - iocs: List of IoCs with source information …

Report local CrowdSentinel system status and connector readiness. This is a read-only local check. It does not contact Elasticsearch, OpenSearch, CTI providers, MISP, or Velociraptor. Use it before an investigation to understand which capabilities are configured, disabled, degraded, or missing. Args: include_details: Include path and environment-variable metadata. Returns: Server, runtime, connector readiness, and workflow guidance.

Hunt for IoCs in stages adjacent to the current attack stage. When you identify activity at one stage of the kill chain, this tool automatically hunts for evidence of the previous stage (to understand how they got there) and the next stage (to predict their next move). **Kill Chain Progression:** Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives Args: index: Index pattern to search current_stage: The stage you've currently identified Options: "RECONNAISSANCE", "DELIVERY", "EXPLOITATION", "INSTA…

Detect network anomalies by comparing against baseline or defaults. Identifies unusual ports, protocol misuse, DNS anomalies, and other suspicious patterns in network traffic. Args: pcap_path: Path to PCAP file to analyze baseline_name: Optional baseline to compare against (uses defaults if not specified) Returns: Dictionary with detected anomalies categorized by type Example: hunt_anomalies("/path/to/suspicious.pcap")

Hunt for indicators of a specific Cyber Kill Chain stage. This tool executes targeted hunting queries designed to find evidence of activity at a specific stage of the Lockheed Martin Cyber Kill Chain. Each stage has multiple specialized queries that look for stage-specific indicators. **The 7 Cyber Kill Chain Stages:** 1. RECONNAISSANCE - Port scans, DNS enumeration, web scanning 2. WEAPONIZATION - (Typically not visible in victim logs) 3. DELIVERY - Phishing emails, malicious downloads, exploit delivery 4. EXPLOITATION - Exploit execution, vulnerability exploitation 5. INSTALLATION - Malwar…

Hunt for specific attack patterns within a timeframe. This tool automatically searches for common attack indicators based on predefined patterns. IoCs are automatically captured to the active investigation if one exists. Args: index: Index pattern to search (e.g., "winlogbeat-*") attack_types: List of attack types to hunt for. Options: - "brute_force": Brute force authentication attempts - "privilege_escalation": Privilege escalation attempts - "lateral_movement": Lateral movement indicators - "persistence": Persistence mechanisms - "suspicious…

Hunt for a specific Indicator of Compromise (IoC) across logs. This tool searches multiple fields based on the IoC type. Args: index: Index pattern to search ioc: The IoC value (IP, domain, hash, filename, etc.) ioc_type: Type of IoC. Options: - "ip": IP addresses (searches source.ip, destination.ip, etc.) - "domain": Domain names (searches dns.question.name, url.domain, etc.) - "hash": File hashes (MD5, SHA1, SHA256) - "filename": File names or paths - "process": Process names - "user": User names timeframe_minutes: Optional tim…

Hunt for specific Indicators of Compromise (IoCs) in a PCAP file. Searches for known-bad IPs, domains, hashes, or other indicators within the network traffic. Args: pcap_path: Path to PCAP file to search iocs: List of IoC values to search for ioc_type: Type of IoC (ip, domain, hash) - auto-detected if not specified Returns: Dictionary with matches found and their context Example: hunt_iocs( pcap_path="/path/to/suspicious.pcap", iocs=["1.2.3.4", "evil.com", "abc123hash"] )

Hunt for all activity associated with a suspicious process. This is a multi-stage ES|QL hunt that: 1. Finds when the suspicious process started and stopped (time bounds) 2. Identifies the host(s) where it ran 3. Queries for child processes spawned during that window 4. Queries for files created/modified during that window 5. Queries for outbound network connections during that window 6. Queries for process access events (credential dumping indicator) 7. Queries for remote thread creation (injection indicator) 8. Queries for DNS queries made by the process 9. Queries for registry modifications…

Execute all rules in a specific category for comprehensive hunting. This tool runs all rules matching a category/log source for thorough threat detection. Args: platform: Target platform (windows, linux, macos) category: Rule category or log source (e.g., "powershell", "process_creation", "audit") index: Index pattern to search timeframe_minutes: Time window in minutes (default: 15) max_rules: Maximum number of rules to execute (default: 10, max: 25) Returns: Aggregated results from all matching rules Example: hunt_with_rule_category( platform="w…

Hunt for threats in EVTX logs using Sigma rules. This tool uses Chainsaw to hunt through Windows Event Logs (EVTX) with Sigma rules, automatically prioritising findings by the Pyramid of Pain and suggesting follow-up hunts. **Default Paths (installed by setup.sh):** - EVTX samples: chainsaw/EVTX-ATTACK-SAMPLES/ - Sigma rules: chainsaw/sigma/ - Mappings: chainsaw/mappings/ Args: evtx_path: Path to EVTX files or directory - Use "chainsaw/EVTX-ATTACK-SAMPLES" for bundled samples - Or provide absolute path: /path/to/evtx/files sigma_rules_path: Path to Sigma …

Creates or updates a document in the index. Args: index: Name of the index document: Document data id: Optional document ID

Execute a specific investigation prompt against Elasticsearch. Run a single triage question from the investigation spine. This allows focused investigation on specific areas. Args: prompt_id: Investigation prompt ID (from show_investigation_prompts) Linux: linux_auth_1, linux_privilege_2, linux_processes_3, linux_persistence_4, linux_network_5 Windows: windows_logon_1, windows_processes_2, windows_powershell_3, windows_persistence_4, windows_privilege_5 index: Index pattern to search timeframe_minutes: Time window in minutes (defaul…

Perform iterative threat hunting starting from an initial IoC. This tool performs multi-stage hunting, automatically discovering related IoCs and pivoting through the Pyramid of Pain levels for comprehensive investigation. **Default Paths (installed by setup.sh):** - EVTX samples: chainsaw/EVTX-ATTACK-SAMPLES/ - Chainsaw binary: chainsaw/chainsaw **Hunting Strategy:** 1. Start with easy-to-track IoCs (IPs, domains, process names) 2. Each iteration discovers new IoCs from results 3. Follow up on high-priority indicators 4. Build complete attack picture using Diamond Model Args: …

List all aliases.

List available CrowdSentinel capabilities grouped by category. Returns: Capability groups for SIEM, endpoint, network, CTI, detection, and case/investigation state based on local readiness checks.

List all available log source schemas in the registry. Returns summary information about each schema including: - Schema ID and name - Source type (sysmon, ecs, windows_security) - Index patterns the schema matches - Supported event types Use this to discover available schemas before running queries. Example: list_available_schemas()

List available detection rules with optional filtering. This tool provides access to the comprehensive rule library containing 5000+ community detection rules for threat hunting. Args: platform: Filter by platform (windows, linux, macos, application, cloud, network) log_source: Filter by log source (powershell, process_creation, builtin, audit, etc.) rule_type: Filter by rule type (lucene, eql) search_term: Search in rule names, tags, and descriptions mitre_tactic: Filter by MITRE ATT&CK tactic (execution, persistence, privilege_escalation, defense_evasion, …

List available ES|QL hunting queries from the curated rule library. ES|QL hunting queries are hypothesis-driven searches with aggregations, thresholds, and anomaly detection - designed to find *patterns* not just *matches*. Args: platform: Filter by platform (linux, windows, macos, aws, azure, okta, llm, cross-platform) mitre_technique: Filter by MITRE technique (e.g., "T1053", "T1059.001") keyword: Search in rule name and description limit: Maximum number of results (default: 50) Returns: Dictionary containing: - total_found: Number of matching rules - rules: Li…

List all indices.

List recent investigations with optional filtering. This tool shows the most recent investigations to help resume work or review past investigations. Args: limit: Maximum number of investigations to return (default: 10) status: Filter by status - "active", "paused", "closed", "archived" include_size: Recalculate actual sizes (slower but accurate) Returns: Dictionary with: - investigations: List of investigation summaries - total_count: Total number of investigations - storage_stats: Current storage usage Example: list_investigations(limit=5, status="active")

Look up a single IoC across all configured threat intelligence providers. Works independently of any investigation — use for ad-hoc lookups. Args: ioc_type: Type of indicator (ip, domain, hash, url) ioc_value: The indicator value providers: Specific providers (default: all applicable) Returns: Aggregated verdict with per-provider details Example: lookup_ioc(ioc_type="ip", ioc_value="1.2.3.4") lookup_ioc(ioc_type="hash", ioc_value="abc123...")

Map Elasticsearch events to Cyber Kill Chain stages. This tool analyzes raw Elasticsearch events and determines which kill chain stage(s) they belong to based on event codes, actions, and content. Args: events: List of Elasticsearch event documents (from any search query) Returns: Mapping of events to kill chain stages including: - Event count per stage - List of events for each identified stage - Stage distribution summary - Timeline of stages (if events have timestamps) Use cases: - Analyze results from threat hunting queries - Map incident timeline to kil…

List running processes via osquery (current host state). Complements Velociraptor's historical view with 'what is running now'. Captures process/path/commandline IoCs to the active investigation. Args: name_filter: Case-insensitive substring to filter on name/path/cmdline. limit: Max rows per page (default 100) so large dumps don't truncate. offset: Row offset for paging; use pagination.next_offset to continue. Returns: Process rows + a `pagination` block ({total, returned, truncated, next_offset}). IoCs are captured from the FULL match set, not just the page. Error …

Run an ad-hoc READ-ONLY osquery SQL query. Only a single SELECT over known osquery virtual tables is permitted — stacked statements, non-SELECT verbs, non-allowlisted tables, and file-write/read/ extension-load functions are rejected (validated with a real SQL parser). See the osquery schema at https://osquery.io/schema for table/column names. Capability note: allowlisted tables such as ``file``, ``hash``, ``registry``, ``sudoers`` and ``authorized_keys`` can read sensitive host data (e.g. file hashes under any path, SSH keys, sudo rules). This is intended DFIR capability (e.g. spotting atta…

List process network sockets via osquery (active connections + listeners). Args: ip_filter: Case-insensitive substring to filter on remote/local address. limit: Max rows per page (default 100) so large dumps don't truncate. offset: Row offset for paging; use pagination.next_offset to continue. Returns: Socket rows + a `pagination` block. IP IoCs are captured from the FULL match set, not just the page.

List user accounts via osquery. Captures username IoCs. Returns: User rows with auto-captured IoCs.

Load and analyze a PCAP file to get an overview of the network traffic. This is typically the first step in network forensics - getting a high-level view of what's in the capture before diving deeper. Args: pcap_path: Path to the PCAP file to analyze Returns: Dictionary containing: - packet_count: Total number of packets - time_range: Start and end timestamps - protocols: Protocol distribution - top_talkers: Most active IP addresses - file_size: Size of the PCAP file Example: pcap_overview("/path/to/capture.pcap")

Create or update an alias for a specific index. Args: index: Name of the index name: Name of the alias body: Alias configuration

Fast triage aggregation - counts without returning documents. Use for quick assessment of activity volume and distribution. Args: index: Index pattern to search group_by: Field to aggregate (e.g., "source.ip", "user.name", "event.code") query: Filter query (default: "*" for all) timeframe_minutes: Time window (default: 60) top_n: Number of top values to return (default: 10) Returns: Aggregation summary with: - total: Total matching documents - groups: Top N values with counts - timeframe: Time window searched Token savings: ~95% compared to search_docume…

Quick triage: Run top N priority prompts for fast initial assessment. This is the fastest way to get initial triage results. Runs only the highest priority questions to quickly identify issues. Args: platform: Target platform ("linux" or "windows") index: Index pattern to search host: Hostname to investigate timeframe_minutes: Investigation window (default: 60 minutes) top_n_prompts: Number of prompts to run (default: 3, max: 5) Returns: Quick triage results Examples: # Quick Windows triage quick_triage( platform="windows", index="winlogbeat-…

Resume an existing investigation and make it active. This loads a previous investigation so new findings will be added to it. All IoCs and timeline events are preserved from previous sessions. Args: investigation_id: ID of the investigation to resume (e.g., "INV-20241228-123456") Returns: Dictionary with: - id: Investigation ID - name: Investigation name - ioc_count: Number of IoCs collected - sources_used: Tools that contributed findings - summary: Brief status summary Example: resume_investigation("INV-20241228-123456")

Search for documents. Args: index: Name of the index body: Search query

Search for a specific IoC in EVTX logs. This tool searches for IPs, domains, process names, hashes, or other indicators in Windows Event Logs, following the Pyramid of Pain prioritisation strategy. **Default Paths (installed by setup.sh):** - EVTX samples: chainsaw/EVTX-ATTACK-SAMPLES/ - Chainsaw binary: chainsaw/chainsaw Args: evtx_path: Path to EVTX files or directory - Use "chainsaw/EVTX-ATTACK-SAMPLES" for bundled samples - Or provide absolute path: /path/to/evtx/files ioc: The indicator to search for (IP address, domain, process name, hash, etc.) ioc…

Search a live MISP instance for a specific IoC. Requires MISP_URL and MISP_API_KEY environment variables. Returns matching attributes with event context. Args: ioc_value: The indicator value to search for ioc_type: Optional IoC type hint (ip, domain, hash, url) Returns: List of matching MISP attributes with event metadata Example: search_misp(ioc_value="203.0.113.42", ioc_type="ip")

Search detection rules by MITRE ATT&CK tactic. This tool helps find rules mapped to specific attack techniques. Args: tactic: MITRE ATT&CK tactic (e.g., "credential_access", "lateral_movement") Valid tactics: - execution - persistence - privilege_escalation - defense_evasion - credential_access - discovery - lateral_movement - collection - command_and_control - exfiltration - impact platform: Optional platform filter (windows, linux, macos) limit: Maximum number of results (default: 50…

Execute a Lucene query string search for flexible threat hunting. Use this for custom queries that don't fit predefined patterns. Args: index: Index pattern to search lucene_query: Lucene query string syntax timeframe_minutes: Optional time window size: Number of results (default: 100) Returns: Search results matching the Lucene query Lucene Query Examples: 1. Search for specific event: 'event.code:4688 AND winlog.event_data.CommandLine:*powershell*' 2. Boolean operators: 'event.code:(4624 OR 4625) AND user.name:admin' 3. Wildcards and ranges:…

Display investigation triage questions for SIEM/SOAR. This tool shows the "fast triage spine" questions that every security analyst should ask when investigating a potential incident. These are the first questions to slam into your SIEM/SOAR. The 10 questions cover: identity → execution → persistence → network → privilege Args: platform: Filter by platform ("linux" or "windows", None for both) show_details: Show detailed information including log sources and fields Returns: Investigation prompts with questions and metadata Examples: # Show all investigation prompts sho…

Token-efficient search with automatic summarization and PAGINATION. Returns a compact summary instead of raw Elasticsearch JSON. Use this instead of search_documents for general queries to save tokens. PAGINATION: Use offset or search_after to page through large result sets. - offset: Skip first N results (simple but inefficient for deep paging) - search_after: Use sort values from previous page (efficient for large sets) Args: index: Index pattern to search (e.g., "winlogbeat-*", "cef-ssh-*") query: Simple query string (e.g., "failed login", "powershell") fields: Fields to retu…

Start a guided investigation with all triage prompts for a platform. This tool presents all investigation questions for the selected platform and allows you to systematically investigate using the triage spine. Args: platform: Target platform ("linux" or "windows") index: Index pattern to search (e.g., "winlogbeat-*", "auditbeat-*") timeframe_minutes: Investigation time window in minutes (default: 60) host: Optional hostname to filter results Returns: Guided investigation results for all prompts Examples: # Investigate Windows endpoint start_guided_investigation…

Analyze your data and suggest applicable detection rules. This tool samples your data to identify what log sources and event types are present, then recommends detection rules that are likely to work with your data. Args: index: Index pattern to analyze (e.g., "winlogbeat-*") sample_size: Number of events to sample (default: 100) max_rules_per_source: Max rules returned per matched log_source (default: 25). The previous hardcoded 5 hid most of an applicable pack (e.g. returned 5 of the 10 auditbeat rules). Returns: Dictionary containing: - data_profile: S…

IR-focused search with automatic IoC extraction, MITRE mapping, and PAGINATION. Combines search_documents + analyze_search_results into a single call. Returns extracted IoCs, MITRE techniques, and recommended follow-ups. PAGINATION: For large investigations, use offset/search_after to page through events. Store discovered IoCs to investigation state for comprehensive coverage. Args: index: Index pattern to search (e.g., "winlogbeat-*") query: Query string for threat hunting timeframe_minutes: Time window to search (default: 60) extract_iocs: Extract IPs, users, processes, co…

Track and reconstruct network sessions from PCAP. Follows TCP/UDP streams, identifying session patterns, data volumes, and communication timelines. Args: pcap_path: Path to PCAP file protocol: Protocol to track (tcp or udp) port_filter: Optional list of ports to filter Returns: Dictionary with session details and summary Example: track_sessions("/path/to/capture.pcap", protocol="tcp")

Validate if a detection rule is applicable to your data. This tool analyzes your data to check if it contains the log sources and fields that the rule expects. Use this before executing rules to understand if they will work with your data. Args: rule_id: The unique rule identifier index: Index pattern to analyze (e.g., "winlogbeat-*") sample_size: Number of sample events to analyze (default: 10) Returns: Dictionary containing: - rule_info: Basic rule information - compatibility: Whether rule is likely compatible - data_analysis: Analysis of your data structure …

Collect evidence of execution from Amcache on a Windows endpoint. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: Amcache entries with auto-captured IoCs.

Enumerate Windows auto-start persistence (Autoruns / Run keys / services). Maps to ATT&CK Persistence (T1547.001 Run Keys, T1543 services). Use this when SIEM findings suggest persistence and you need on-endpoint confirmation. Args: client_id: Velociraptor client ID (from velociraptor_client_info). Fields: Comma-separated fields to return, or '*' for all (default). '*' is recommended — the Windows.Sysinternals.Autoruns columns are space-named ("Image Path", "Launch String", "Entry Location", "SHA-1"), which the IoC extractor (smart_extractor.vr_field_map) maps…

Extract evidence of execution from the BAM (Background Activity Moderator) registry key. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: BAM entries with auto-captured IoCs.

Find a Velociraptor endpoint by hostname or FQDN. Returns client metadata including client_id, OS type, agent version, and last-seen timestamp. The client_id is required for all other Velociraptor tools. If you don't already know the hostname, call velociraptor_list_clients first to enumerate enrolled endpoints. Args: hostname: Hostname or FQDN of the target endpoint. Returns: Client metadata dict with client_id, or error message.

Start a generic Velociraptor artifact collection. Use this for artifacts not covered by the specialized tools. Returns flow metadata — use velociraptor_get_collection_results to retrieve results. Args: client_id: Velociraptor client ID. artifact: Artifact name (e.g. 'Windows.KapeFiles.Targets'). parameters: Comma-separated key=value pairs for the artifact. Quotes are OPTIONAL — pass the literal value. Values may contain commas, braces and backslashes; multi-path brace-expansion globs work. Examples: "SearchFilesGlob=/tmp/*" "SearchFiles…

Collect evidence of file downloads on a Windows endpoint. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: Download evidence with auto-captured IoCs.

Collect Windows event-log (EVTX) records from an endpoint. Use to pull on-host event logs when central forwarding is incomplete or you need the raw record. IdRegex filters by event ID (e.g. '4624|4688'). Args: client_id: Velociraptor client ID. IdRegex: Regex matched against event IDs (default '.' = all). Fields: Comma-separated fields to return, or '*' for all. Returns: EVTX records with auto-captured IoCs.

Retrieve results from a previously started Velociraptor collection. Polls for completion and returns results when the flow finishes. Args: client_id: Velociraptor client ID. flow_id: Flow ID from velociraptor_collect_artifact. artifact: Artifact name that was collected. fields: Comma-separated fields to return. max_retries: Number of retry attempts. retry_delay: Seconds between retries. Returns: Collection results with auto-captured IoCs.

List groups on a Linux endpoint. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: Group list.

List available Velociraptor artifacts for an OS. Args: os_filter: OS filter — 'windows' or 'linux'. Returns: List of artifacts with names, descriptions, and parameters.

List every enrolled Velociraptor endpoint (the fleet) — START HERE. This is the Velociraptor discovery entry point. Every other velociraptor_* tool requires a client_id, so call this FIRST to see which endpoints are enrolled and copy the client_id of the host you want to investigate. Takes no required arguments — do NOT guess hostnames. Args: limit: Max clients to return, most-recently-seen first (1..1000). Returns: {"clients": [...], "total": N}. Each client has client_id, Hostname, Fqdn, OSType, OS, Machine, AgentVersion, FirstSeen, LastSeen. An empty list means no endpoin…

Parse Windows .lnk shortcut files for execution evidence. Maps to ATT&CK Execution (T1204.002 Malicious File). Reveals what a user or attacker launched, including the target path and arguments. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return, or '*' for all. Returns: Parsed .lnk entries with auto-captured IoCs.

List mounted filesystems on a Linux endpoint. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: Mount list.

List network connections with process metadata on an endpoint. Args: client_id: Velociraptor client ID. os_type: Operating system — 'windows' or 'linux'. IPRegex: Regex to filter IP addresses. PortRegex: Regex to filter ports (e.g., '^443$'). ProcessNameRegex: Regex to filter process names. ConnectionStatusRegex: Regex to filter connection status. Fields: Comma-separated fields to return, or '*' for all. Returns: Network connection list with auto-captured IoCs.

Search the NTFS MFT for files by name or path on a Windows endpoint. This is a forensic-grade search. FileRegex is more performant than PathRegex. Args: client_id: Velociraptor client ID. FileRegex: Regex to match filenames. PathRegex: Regex to match file paths (more expensive). MFTDrive: Target drive letter (default: C:). DateAfter: Filter for files after this timestamp. DateBefore: Filter for files before this timestamp. Fields: Comma-separated fields to return. Returns: MFT entries with auto-captured IoCs.

Parse Prefetch files on a Windows endpoint to identify previously executed programs. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: Prefetch entries with auto-captured IoCs.

List running processes on an endpoint (Windows or Linux). Args: client_id: Velociraptor client ID (from velociraptor_client_info). os_type: Operating system — 'windows' or 'linux'. ProcessRegex: Case-insensitive regex to filter process names. Fields: Comma-separated fields to return, or '*' for all. Returns: Process list with auto-captured IoCs.

Collect RecentDocs from Registry on a Windows endpoint. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: RecentDocs entries with auto-captured IoCs.

List scheduled tasks (persistence) on a Windows endpoint. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: Scheduled tasks with auto-captured IoCs.

List services with metadata on a Windows endpoint. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: Services with auto-captured IoCs.

Collect Shellbags from Registry on a Windows endpoint. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: Shellbag entries with auto-captured IoCs.

Parse ShimCache (AppCompatCache) entries from the registry. Note: Presence in ShimCache may not indicate actual execution. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: ShimCache entries with auto-captured IoCs.

Collect the Windows SRUM database (resource-usage / network history). SRUM records per-application network bytes and execution over ~30 days — useful for spotting exfiltration or beaconing processes after the fact. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return, or '*' for all. Returns: SRUM rows with auto-captured IoCs.

Extract evidence of execution from UserAssist registry keys. Args: client_id: Velociraptor client ID. Fields: Comma-separated fields to return. Returns: UserAssist entries with auto-captured IoCs.

List users on an endpoint. Args: client_id: Velociraptor client ID. os_type: Operating system — 'windows' or 'linux'. Fields: Comma-separated fields to return. Returns: User list with auto-captured IoCs.