incident_response_evidence_collector
Read-onlyIdempotent
As a CTO, gather forensic evidence (logs, network flows, MITRE TTPs) from public breach reports and threat intelligence sources to support incident response post-mortems. Inputs include incident identifiers, date ranges, or MITRE technique IDs. Outputs structured evidence with attack patterns, indicators of compromise, and source references. — pass async:true REQUIRED to avoid x402 timeout.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| async | No | If true, returns a job_id immediately (<200ms) instead of waiting for the result. Poll the result with job_result(job_id). Use for slow tools to avoid client timeouts. | |
| date_range | No | ||
| incident_id | Yes | Unique identifier for the incident (e.g., CVE, GitHub Advisory ID) | |
| mitre_technique_ids | No | List of MITRE ATT&CK technique IDs (e.g., T1059) | |
| include_network_flows | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| status | Yes | ||
| sources | No | ||
| timeline | No | ||
| warnings | No | ||
| indicators | No | ||
| incident_id | No | ||
| network_flows | No | ||
| attack_patterns | No |