Above Security

List all evidence items (screenshots, app context, uploaded files) attached to ONE incident by UUID. Each item includes its public download URL (presigned, time-limited).

Return the chronological activity timeline for ONE incident by UUID. Includes events, actions, status transitions. Cheaper than refetching the full incident.

List incidents in this tenant (optionally filtered by severity, status, verdict, or type), returning each incident's summary fields (UUID, external id, severity, status, verdict, type, and the involved identity). Use get_incident for one incident's full detail.

List investigation insights and reports (optionally filtered by identity email, report type, year, or week number), returning report records and summaries. Does not return raw incident detail.

Search across identities, incidents, applications, and browser extensions in this tenant. Returns sectioned results — each section has hits with name/uuid/score. Use when you have a name/email/incident-ID substring but not a UUID. Minimum 3 characters required (canonical incident IDs like 'INC-42' bypass the length check).

List devices in this tenant (UUID, name, email, status, last-seen, created). Supports substring search across name/email/UUID, sort by createdAt|name|lastActivityAt, paginate. Use get_device for the per-device detail (incl. linked identity).

List identities at HIGH or CRITICAL risk (UUID, name, email, risk score), optionally filtered by severity and limit. A tenant-wide ranked view of the riskiest identities.

List identities in this tenant with full filters (substring search across name/email/UUID, minimum risk score, sort, paginate). For 'just the risky ones' use list_high_risk_identities instead — this is the full browse.

Query the company's portal audit log (who did what, when, from where). Admin/SystemAdmin only — non-admin keys will be rejected at the route layer with 403. Filters by action, date range, portal user, and limit (max 200).

Remove an identity from the company Person-of-Interest watch list. Returns a clear 'not_on_watch_list' result (not an error) when the identity was not flagged, so it is safe to call unconditionally. Requires an Admin role (HR/Legal/User/IT cannot call). Resolve an email to a UUID with get_identity_uuid first.

Deep escalation search for broad investigative questions the direct entity tools cannot answer. Use this ONLY when the focused tools (get_identity_*, get_incident*, get_device/list_devices, get_applications/get_extensions, get_alerts, get_insights, list_high_risk_identities, query_audit_logs) genuinely cannot answer — questions that require searching and correlating raw user activity and events across the tenant (e.g. "has anyone exfiltrated data to personal cloud storage in the last month?", "which users accessed competitor sites and also touched sensitive files?"). This is the slow, heavyweight path: it triggers a background investigation that searches and correlates raw events end-to-end. Results are NOT returned inline by this tool. Calling it signals that you want to escalate; the deeper search runs in the background and its answer is delivered to this thread when ready. Do NOT call it for a question a direct tool can answer, and do NOT expect data back in the same turn. Disambiguation from global_search: use global_search for a FAST cross-entity lookup of already-known objects (find a specific identity, incident, device, or application by name/identifier); use search_discovery for a SLOW deep search that explores and correlates raw activity to answer an open-ended investigative question.

Set the resolution notes on an incident (free-form text, max 4000 chars). Note: this REPLACES the current notes — to extend existing notes, the caller is responsible for fetching them first via get_incident and concatenating. Requires non-restricted role.

Update an incident's status (Open, InProgress, Resolved, Dismissed, AutoResolved). Use this to triage incidents. The Hidden state cannot be set here — use the False Positive flow in the portal instead. Requires non-restricted role (HR/Legal cannot call).

Set an incident's verdict (Pending, Confirmed, FalsePositive, NeedsReview, Benign). Use this to record analyst judgement on whether an incident is a true positive or false positive. 'Benign' marks real, correctly-detected activity that is not concerning/acceptable — unlike FalsePositive it does not feed the false-positive training pipeline. Requires non-restricted role.