qradar_update_offense

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden. It discloses that this is a mutation, that closing_reason_id is required when closing, and that it returns a JSON string of updated offense details. However, it does not state whether omitted fields are preserved or cleared, nor any permission or error behavior, leaving some ambiguity for a write operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose sentence is front-loaded and the Args/Returns structure makes scanning easy. Minor redundancy exists because status values are given twice (in the intro and in the Args list), but the overall length is appropriate for six parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a six-parameter mutation with no annotations, the description is largely complete: it explains all parameters, the conditional closing-reason requirement, and the return format. It is slightly incomplete on partial-update semantics (whether omitted fields are unchanged) and does not mention error cases, but an agent has enough to construct a valid call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must explain every parameter. It does: offense_id is identified as the ID, status lists allowed values, closing_reason_id is tied to closing, assigned_to is an analyst username, follow_up is a flag, and protected prevents automatic purging. This fully compensates for the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Update an offense status... closing reason, assignment or flags') and enumerates the affected fields. This clearly distinguishes it from sibling update tools like qradar_update_rule by naming the offense resource directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context is clear: use this tool to modify an existing offense. It also provides a conditional usage rule ('Required if closing the offense') and points to the sibling qradar_list_closing_reasons for valid IDs. It does not explicitly state when not to use it versus read-only offense tools, but the mutation intent is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.