Available tools

CloudSEK MCP exposes three tool groups:

• CloudSEK platform tools read your organization's alerts, incidents, events, evidence, and audit data.
• Incident and event update tools change CloudSEK records and report the result for verification.
• GTI tools query external threat intelligence for actors, feeds, IOCs, and CVEs.

You do not need to call tools by name. State the outcome you want. Your AI client selects the tools and asks for approval according to its own policy.

CloudSEK platform tools

These tools require your Bearer token and Org ID.

Tool	What it does	Common use
get_alerts	Fetches alerts with CVEs, IOCs, remediation steps, and threat tags across CloudSEK modules.	Morning triage, alert investigation, CVE review
get_snapshot	Lists and filters incidents or events by status, priority, assignee, module, and other supported fields.	Open P0 review, unassigned work, queue health
get_changelog	Returns status, priority, assignment, and comment history for a record.	Audit checks, ownership review, escalation preparation
get_triage_brief	Produces a daily queue summary with priorities, analyst actions, and unassigned critical items.	Shift handoff, standup, daily SOC review
get_incident_ops_summary	Summarizes overdue work and potential SLA breaches.	Weekly operations review, escalation tracking
get_threat_landscape_summary	Summarizes activity and severity by CloudSEK module.	Leadership reports, active module review
get_prompt_examples	Returns prompts filtered by persona, use case, or product.	Onboarding, prompt discovery
get_brand_context	Returns CloudSEK naming, product hierarchy, logo references, and design tokens.	Reports and product naming checks
get_attachments	Retrieves event evidence such as screenshots, text dumps, archives, code repositories, and password attacks.	Evidence review before closure or remediation

Incident and event update tools

Write permission required

These tools require a Bearer token with write access, which every Alerts API token issued from 30 July 2026 carries. Rotate an older token under Integrations → Alerts API → Rotate Token to enable them. Each single-record write returns an operation_id. Bulk operations return a job_id for use with get_job_status.

Tool	What it does	Common use
update_incident	Changes one incident's status, priority, assignee, or comment. Several fields can change in one call.	Acknowledge, escalate, assign, or close an incident
update_event	Changes one event's status, assignee, or comment. It can remediate an event when setting a closed status.	Event acknowledgement, closure, and remediation
reassign_incident	Assigns, reassigns, or unassigns one incident without changing status or priority.	Ownership changes and shift handoff
reassign_event	Assigns, reassigns, or unassigns one event.	Event ownership changes
post_comment	Adds a comment to an incident or event. It can include an optional Jira or ServiceNow reference. Identical comments are deduplicated.	Investigation notes and ticket correlation
bulk_update_incidents	Changes status, priority, or assignee for incidents selected by explicit IDs or filters.	Queue cleanup, campaign response, analyst offboarding
bulk_update_events	Changes status or assignee for up to 500 events selected by record identifiers.	Coordinated event remediation
get_job_status	Reports per-record success, skipped, and failed results for a bulk job.	Bulk verification and targeted retries

How writes behave

• Incidents use display IDs such as XVA-1234. Internal UUIDs are not accepted.
• Events use the opaque event record identifier returned by CloudSEK tools.
• Incident status values are exact and case-sensitive: Open, InProgress, Reopen, Acknowledged, ClosedFalsePositive, ClosedIrrelevant, ClosedResolved, and ClosedInformational.
• Incident priority values are P0, P1, and P2. Values such as High or Medium are rejected.
• Events do not have a priority field. Event severity is read-only and appears as threat_magnitude, such as critical, high, medium, or low.
• Remediating an event requires one of the four Closed statuses.
• A bulk job performs one operation: a status change, an incident priority change, or an assignee change, with an optional comment. Changing two fields across the same records creates two jobs.
• Bulk jobs run asynchronously. Poll get_job_status until the job finishes, then inspect failed and skipped records.
• Repeating an unchanged update is a safe no-op. An unchanged record can return success with changed: false.
• Identical comments on the same record are deduplicated.
• Ask to unassign a record to clear ownership. Include a Jira or ServiceNow system name, ticket ID, and HTTPS URL when adding an external reference.

Safe write pattern

Inspect the matching records first. Confirm the count and identifiers. Ask for approval before changing them. Verify a single write through get_changelog, or verify a bulk write through get_job_status.

GTI Global Threat Intelligence tools

GTI tools are available on hosted CloudSEK MCP deployments and need no additional credentials.

Threat actor intelligence

Tool	What it does
get_top_threat_actors	Ranks threat actors by recent activity.
threat_actor_list	Filters actors by tags, date ranges, or keywords.
get_threat_actor_by_name	Searches for an actor by name or alias.
get_threat_actor_by_id	Returns one actor profile, aliases, tags, activity, and feeds by UUID.
get_threat_actors_by_ids	Returns profiles for up to 10 actor IDs.

Threat feeds

Tool	What it does
list_top_viewed_feeds	Lists current popular and trending GTI feeds.
list_advanced_feeds	Filters feeds by tags, dates, module, or actor name.
filter_feeds_by_tag	Filters feeds by one tag, such as phishing, malware, or industry.
get_gti_feed_details	Returns the content, IOCs, CVEs, actors, and summary for one feed.
get_gti_feed_details_batch	Returns content for several feeds in one call.
get_gti_feed_details_with_context	Adds related indicators and correlated threat context to feed details.
gti_aggregate	Analyzes trends across industries, malware families, countries, and other tag dimensions.

CVE intelligence

Tool	What it does
get_trending_cves	Lists CVEs trending in dark web discussions, exploit mentions, and actor activity.
get_cve_intel	Finds GTI feed intelligence and actor activity for one or more CVE IDs.
get_cve_context	Returns severity, affected products, patch availability, and known exploitation.

IOC lookup and search

Tool	What it does
ioc_lookup	Checks one IP address, domain, file hash, or URL and returns labels, confidence, and threat context.
ioc_search	Searches indicators by actor, malware family, or keyword.
ioc_search_advanced	Filters indicators by score, type, confidence, and date range.
ioc_indicator_details	Returns full details for an indicator UUID or STIX ID.
ioc_labels	Lists available IOC labels and usage counts.

Tag discovery

Tool	What it does
resolve_gti_tag_values	Finds valid values for a known GTI tag, such as country or industry.
discover_gti_tag_values_across_tags	Finds matching tags and values when you do not know which tag to use.