lookup-observable
Identify and route security observables (IPs, domains, URLs, emails) to the appropriate enrichment service for quick threat analysis and insights.
Instructions
A generic tool which takes any observable and passes it the correct tool.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| value | Yes |
Implementation Reference
- server.py:55-62 (handler)The handler function for the 'lookup-observable' tool. It imports Action from security_cli, initializes it if needed, and calls enrich on the provided value.async def lookup(value: str) -> str: from security_cli.action import Action if not enrichmentmcp: enrichmentmcp = Action() return enrichmentmcp.enrich(value)
- server.py:65-69 (registration)Registration of the 'lookup-observable' tool using mcp.add_tool, linking the lookup handler function to the tool name.mcp.add_tool( lookup, name="lookup-observable", description="A generic tool which takes any observable and passes it the correct tool.", )