Tools provided
Tools the agent exposes — your AI client calls them automatically when it needs them.
- run_full — Run the full SIEM triage pipeline end-to-end: fetch alerts (read-only), normalize, correlate/triage deterministically, synthesize an analyst narrative (LLM with template fallback), return the full result JSON.
- fetch_alerts — Fetch raw alerts from the SIEM connector (READ-ONLY; mock/provided data offline). Returns the raw alert envelope without triage.
- normalize_alerts — Deterministically normalize raw alerts: map severity, mask PII sources, sanitize free text, apply severity_min filter. No LLM.
- correlate_and_triage — Deterministically correlate/group normalized alerts by signature+source, count, suppress noise/flapping, and priority-score. No LLM.
- narrate_findings — Produce the deterministic template narrative + summary for already-triaged groups (no LLM, no network; grounded only in provided data).
- list_capabilities — List the agent's static capabilities: tools, guardrails, credential slots, and triage knobs.
- plan_inputs — Plan/brainstorm the inputs for a tool: returns the questions, schema and a ready-to-edit example.
