{"tools":[{"name":"correlate","owner":"correlate","description":"Send the incident's raw SIEM events to the Correlate service and get back observations, relationships, and scored attack chains. Run this FIRST — everything else builds on its output.","risk":"read-only","timeoutMs":15000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate"},{"name":"map_attack","owner":"investigate","description":"Map the correlated observations onto MITRE ATT&CK techniques and produce an ordered kill chain by tactic. Use to explain adversary progression.","risk":"read-only","timeoutMs":2000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate"},{"name":"lookup_technique","owner":"investigate","description":"Look up one technique in the pinned official Enterprise ATT&CK 19.1 STIX subset.","risk":"read-only","timeoutMs":1000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate"},{"name":"search_techniques","owner":"investigate","description":"Search the pinned official Enterprise ATT&CK 19.1 STIX subset by ID, name, or tactic.","risk":"read-only","timeoutMs":1000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate"},{"name":"build_timeline","owner":"investigate","description":"Return the correlated observations in chronological order, optionally scoped to an entity id. Use to reconstruct the sequence of events.","risk":"read-only","timeoutMs":2000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate"},{"name":"verify_claim","owner":"evidence","description":"Send a factual claim about the incident to the Evidence service for verification, attaching correlated observations/relationships as evidence. Returns a verdict (SUPPORTED / UNSUPPORTED / …) with per-rule checks and a signed digest. Use to validate the key conclusion.","risk":"read-only","timeoutMs":12000,"retryPolicy":"none","authPolicy":"public-read","tracePolicy":"propagate"}],"dependencies":[{"name":"correlate","mode":"unknown","target":"https://correlate.platphormnews.com"},{"name":"evidence","mode":"unknown","target":"https://evidence.platphormnews.com"},{"name":"attack","mode":"local-engine","target":"pinned ATT&CK mapping engine"}]}