Browse the IP hierarchy tree (Spaces → Blocks → Subnets) with utilization data. USE THIS to navigate and drill into network structure. For executive dashboards use get_network_summary(). For keyword search use search_infrastructure().

Args: scope: Optional IP space name to focus on (e.g., "prod", "corp"). If not set, shows all spaces. depth: Level of detail — "summary" (counts only), "blocks" (include address blocks), or "full" (include subnets) limit: Max items per category (address blocks, subnets) per space. Default 500.

Returns: Hierarchical network view with utilization percentages

Examples: - explore_network() → overview of all IP spaces with counts - explore_network(scope="prod") → detailed view of the prod IP space - explore_network(depth="full") → complete hierarchy with all subnets

Find resources by keyword across all DDI domains (IP, hostname, domain, comment). USE THIS when looking for something specific by name or address. For hierarchy browsing use explore_network(). For dashboards use get_network_summary().

Args: query: Search term (IP address, hostname, domain name, comment text, etc.) types: Optional list of resource types to search. If not set, searches all types. limit: Maximum results per type (default: 20, max: 100)

Returns: Matching resources grouped by type

Examples: - search_infrastructure(query="10.20.3") → finds subnets, hosts, addresses matching - search_infrastructure(query="web-prod", types=["hosts", "dns_records"]) - search_infrastructure(query="example.com", types=["dns_records"])

Get an executive dashboard with counts and health across all DDI infrastructure. USE THIS for high-level overviews and reporting. For hierarchy browsing use explore_network(). For keyword search use search_infrastructure().

Args: scope: Optional IP space name to focus on. If not set, summarizes everything.

Returns: Summary with counts, utilization percentages, and health status

Examples: - get_network_summary() → full infrastructure overview - get_network_summary(scope="production") → production space only

Provision a complete host in one step: creates IPAM host + IP + optional DNS A/PTR records. USE THIS when adding a new host to the network. For DNS-only changes use provision_dns(). To remove a host use decommission_host().

IMPORTANT: Runs in dry_run mode by default — shows what WOULD be created without actually creating. Set dry_run=False to execute the actual provisioning.

IMPORTANT: When a zone is provided, ASK the user whether they want auto_dns=True (recommended, lets the API create DNS records atomically with the host) or auto_dns=False (creates DNS A/PTR records as separate steps after host creation, giving more control but less atomicity).

Args: hostname: Host name (e.g., "web-prod-01"). If zone is provided, will be used as FQDN: hostname.zone space: IP space name or ID where the host should be created (e.g., "prod", "corp", or full resource ID) ip: Optional specific IP address. If not provided, auto-assigns the next available IP from the subnet. zone: Optional DNS zone name for creating A/PTR records (e.g., "prod.example.com") view: Optional DNS view name or ID. Required when a zone exists in multiple views (e.g., "default", "Azure.private-2") subnet: Optional subnet address (CIDR) or ID for auto-IP assignment (e.g., "10.10.20.0/24"). Required when multiple subnets exist in the space and no IP is specified. auto_dns: If True (default), DNS records (A + PTR) are auto-generated atomically by the API during host creation — this matches the "Auto-generate DNS records" option in the UI. If False, DNS A and PTR records are created as separate API calls after host creation. dry_run: If True (default), only shows what would be created. Set to False to actually provision. comment: Optional description for the host

Returns: Complete provisioning result with host, IP, and DNS record details

Examples: - provision_host(hostname="web-01", space="prod", ip="10.20.3.50", zone="prod.example.com") → DRY RUN - provision_host(hostname="web-01", space="prod", ip="10.20.3.50", zone="prod.example.com", dry_run=False) - provision_host(hostname="db-replica-02", space="corp", subnet="10.10.20.0/24", dry_run=False)

Create a new DNS record with automatic zone discovery and validation. USE THIS to create records. For update/delete/list use manage_dns_record().

IMPORTANT: Runs in dry_run mode by default — shows what WOULD be created without actually creating. Set dry_run=False to execute the actual DNS record creation.

Args: name: Record name (e.g., "www" for www.example.com, or full FQDN "www.example.com") record_type: DNS record type value: Record value — IP for A/AAAA, domain for CNAME/MX/PTR/NS, text for TXT zone: DNS zone name (e.g., "example.com"). If not provided, extracted from the name. view: Optional DNS view name or ID. Required when a zone exists in multiple views (e.g., "default", "Azure.private-2") ttl: Time to live in seconds (optional) dry_run: If True (default), only shows what would be created. Set to False to actually create. comment: Optional description

Returns: Created DNS record details

Examples: - provision_dns(name="www", record_type="A", value="10.20.3.50", zone="example.com") → DRY RUN - provision_dns(name="www", record_type="A", value="10.20.3.50", zone="example.com", dry_run=False) - provision_dns(name="app.example.com", record_type="CNAME", value="lb.example.com", dry_run=False)

Decommission a host: removes IPAM host, DNS records, and releases IP addresses. USE THIS to fully remove a host. For partial cleanup use manage_dns_record() or manage_ip_reservation().

IMPORTANT: Runs in dry_run mode by default — shows what WOULD be deleted without actually deleting. Set dry_run=False to execute the actual decommission.

Args: identifier: Hostname, FQDN, or IP address to decommission dry_run: If True (default), only shows what would be deleted. Set to False to actually delete.

Returns: List of resources that were (or would be) deleted

Examples: - decommission_host(identifier="web-prod-01") → shows what would be deleted - decommission_host(identifier="web-prod-01", dry_run=False) → actually deletes everything - decommission_host(identifier="10.20.3.50") → finds and decommissions host at this IP

Diagnose DNS resolution problems for a domain: checks zone, records, and security policies. USE THIS when a domain isn't resolving or has DNS issues. For IP-level issues use diagnose_ip_conflict(). For infrastructure-wide health use check_infrastructure_health().

Args: domain: Domain name to diagnose (e.g., "web-prod-01.example.com" or "example.com") view: Optional DNS view name or ID. Required when a zone exists in multiple views (e.g., "default", "Azure.private-2") flush_cache: If True, flushes the DNS cache for the domain before diagnosing. Useful when DNS changes aren't propagating. ASK the user before flushing.

Returns: Diagnostic report with zone status, records found, and recommendations

Examples: - diagnose_dns(domain="app.example.com") → checks zone, A/AAAA/CNAME records, security - diagnose_dns(domain="app.example.com", view="default") → checks in specific view - diagnose_dns(domain="app.example.com", flush_cache=True) → flushes cache then diagnoses

Check an IP address for conflicts: overlapping subnets, duplicate reservations, DHCP usage, and host associations. USE THIS when troubleshooting IP conflicts or verifying an IP is safe to use. For DNS-level issues use diagnose_dns(). For infrastructure-wide health use check_infrastructure_health().

Args: address: IP address to check (e.g., "10.20.3.50")

Returns: Conflict report with overlapping resources, DHCP lease status, host associations, and recommendations

Examples: - diagnose_ip_conflict(address="10.20.3.50") → checks for conflicts on this IP - diagnose_ip_conflict(address="192.168.1.1") → checks subnet membership and reservations

Verify Infoblox API connectivity for all three service clients (DDI, Insights, ATCFW). USE THIS to diagnose connection issues, check if API keys are valid, or verify the MCP server can reach Infoblox. For infrastructure health (HA groups, DNS zones, etc.) use check_infrastructure_health().

Returns: Health status for each API client with response times

Examples: - check_api_health() → shows which APIs are reachable and response latency

Check the health of all DDI infrastructure components: HA groups, DHCP hosts, DNS zones, DNS views, and IP spaces. USE THIS for operational health monitoring and alerting. For capacity planning use get_ip_utilization(). For security health use assess_security_posture().

Returns: Health report with HA status, DHCP status, DNS status, DNS views, and recommendations

Examples: - check_infrastructure_health() → full health check of all DDI components

Investigate active security threats: aggregates SOC insights, indicators, affected assets, and timeline events. USE THIS for threat investigation and incident response. For policy compliance use assess_security_posture(). For triage actions use triage_security_insight().

Args: query: Optional search term or threat type (e.g., "malware", "phishing", "data_exfiltration") priority: Filter by priority level limit: Maximum insights to return (default: 20)

Returns: Aggregated threat intelligence with indicators, affected assets, events timeline, and recommendations

Examples: - investigate_threat() → all open security insights - investigate_threat(priority="critical") → critical threats only - investigate_threat(query="malware") → malware-related insights

Assess overall DNS security posture: policies, named lists, category filters, compliance, and analytics. USE THIS for security audits and compliance reporting. For active threat investigation use investigate_threat(). For triage actions use triage_security_insight().

Returns: Security posture assessment with policy status, category filter coverage, compliance findings, and recommendations

Examples: - assess_security_posture() → full security assessment

Get IP address utilization percentages for capacity planning. USE THIS to find overutilized subnets and plan expansions. For hierarchy browsing use explore_network(). For infrastructure health use check_infrastructure_health().

Args: scope: Optional IP space name to focus on. If not set, shows all.

Returns: Utilization report with percentages per space/block/subnet

Examples: - get_ip_utilization() → all spaces - get_ip_utilization(scope="production") → production space only

Manage IPAM network resources: create, update, delete, get, list, and allocate next-available subnets/blocks. USE THIS for IPAM CRUD operations. For IP reservations use manage_ip_reservation(). For utilization use get_ip_utilization().

IMPORTANT: Delete runs in dry_run mode by default — shows impact without deleting. next_available_subnet and next_available_address_block require resource_type="address_block" + resource_id + cidr.

Args: resource_type: Type of IPAM network resource to manage action: Operation to perform name: Resource name (for create or lookup) address: CIDR notation for subnets/blocks (e.g., "10.20.0.0/16"), or IP for ranges space: IP space name or ID (required for create) start: Start IP for ranges end: End IP for ranges resource_id: Resource ID for get/update/delete/next_available_* cidr: CIDR prefix length for next_available_subnet/next_available_address_block (e.g., 24) count: Number of resources to allocate (default 1) for next_available_* actions comment: Description tags: Optional tags dict dry_run: If True (default), delete shows impact only. Set False to execute.

Returns: Operation result with resource details

Examples: - manage_network(resource_type="subnet", action="create", address="10.20.3.0/24", space="prod", comment="Web servers") - manage_network(resource_type="subnet", action="get", resource_id="ipam/subnet/abc123") - manage_network(resource_type="range", action="create", start="10.20.3.100", end="10.20.3.200", space="prod") - manage_network(resource_type="address_block", action="delete", resource_id="ipam/address_block/xyz", dry_run=False) - manage_network(resource_type="address_block", action="next_available_subnet", resource_id="ipam/address_block/xyz", cidr=24) - manage_network(resource_type="address_block", action="next_available_address_block", resource_id="ipam/address_block/xyz", cidr=20)

Manage DNS zones, views, RPZ, delegations, ACLs, NSGs, servers, hosts, services, and global config. USE THIS for zone lifecycle operations. For DNS record CRUD use manage_dns_record(). For record creation use provision_dns().

Quick routing guide:

• Authoritative zones: resource_type="auth_zone" (default) → create, list, get, delete, sign, unsign, dnssec_status, copy

• Forward zones: resource_type="forward_zone" → create, list, copy

• DNS views: resource_type="dns_view" → create, list, get, update, delete

• RPZ (Response Policy Zones): resource_type="rpz" → create, list, get, update, delete, reorder

• Delegations: resource_type="delegation" → create, list, get, update, delete

• DNS ACLs: resource_type="dns_acl" → create, list, get, update, delete

• Auth NSGs: resource_type="auth_nsg" → create, list, get, update, delete

• Forward NSGs: resource_type="forward_nsg" → create, list, get, update, delete

• DNS Servers: resource_type="dns_server" → create, list, get, update, delete

• DNS Hosts: resource_type="dns_host" → list, get, update

• DNS Services: resource_type="dns_service" → list, get

• DNS Global: resource_type="dns_global" → get, update

IMPORTANT: ALL mutating actions (create, update, delete) default to dry_run=True and must be explicitly set to dry_run=False to execute. sign/unsign/dnssec_status only work with auth_zone. reorder only works with rpz.

View scoping: when view is supplied on list/get/delete, it MUST be the exact DNS view name configured in Infoblox (not the literal string "default" unless the customer named a view that). Use manage_dns_zone(action="list", resource_type="dns_view") to see the actual view names first. UUIDs (dns/view/...) are also accepted.

Args: action: Operation to perform resource_type: DNS resource type to manage fqdn: Zone FQDN for create/delete (e.g., "example.com") name: Name for dns_view/acl/nsg/server create primary_type: For auth/rpz zones — "cloud" or "external" view: DNS view name (optional) target_view: Target view for copy action forward_to: List of forwarder IPs for forward zones delegation_servers: List of delegation server objects for delegation create zone_ids: List of zone IDs for sign/unsign/reorder operations disabled: Set zone disabled state (for update) comment: Description resource_id: Resource ID for get/update/delete/dnssec_status/copy tags: Resource tags dry_run: If True (default), delete shows record count only. Set False to execute.

Returns: Zone operation result

Examples: - manage_dns_zone(action="list") → all authoritative zones - manage_dns_zone(action="list", resource_type="dns_acl") → all DNS ACLs - manage_dns_zone(action="create", resource_type="dns_acl", name="internal-acl") - manage_dns_zone(action="create", resource_type="auth_nsg", name="primary-nsg") - manage_dns_zone(action="copy", resource_type="auth_zone", resource_id="dns/auth_zone/abc", target_view="external") - manage_dns_zone(action="get", resource_type="dns_global") - manage_dns_zone(action="list", resource_type="dns_service") → all DNS services - manage_dns_zone(action="sign", resource_type="auth_zone", zone_ids=["dns/auth_zone/abc"]) - manage_dns_zone(action="reorder", resource_type="rpz", zone_ids=["id1", "id2"]) - manage_dns_zone(action="delete", fqdn="old.example.com", dry_run=False)

Manage RPZ (Response Policy Zone) rules — the individual DNS override entries within an RPZ zone. For RPZ zone lifecycle (create/delete the zone itself) use manage_dns_zone(resource_type='rpz').

Args: action: Operation to perform zone: RPZ zone ID (required for create and list with zone filter) name: Rule name / trigger FQDN (required for create) resource_id: Rule ID for get/update/delete rdata: Rule response data dict (required for create, e.g. {"type": "CNAME", "cname": "."}) comment: Description disabled: Disable/enable rule (for update) dry_run: If True (default), delete shows rule only. Set False to execute.

Returns: RPZ rule operation result

Examples: - manage_rpz_policies(action="list") → all RPZ rules - manage_rpz_policies(action="list", zone="dns/rpz_zone/abc") → rules in a zone - manage_rpz_policies(action="get", resource_id="dns/rpz_rule/xyz") - manage_rpz_policies(action="create", zone="dns/rpz_zone/abc", name="bad.example.com", rdata={"type": "CNAME", "cname": "."}) - manage_rpz_policies(action="update", resource_id="dns/rpz_rule/xyz", disabled=True) - manage_rpz_policies(action="delete", resource_id="dns/rpz_rule/xyz", dry_run=False)

Manage DNSSEC key lifecycle for authoritative zones: sign, unsign, check status, export trust anchors, delete keys, and import keysets. For zone management use manage_dns_zone(). For RPZ rules use manage_rpz_policies().

Args: action: DNSSEC operation to perform zone_id: Single zone ID for status/delete_key/import_keyset operations zone_ids: List of zone IDs for sign/unsign/export_trust_anchors operations key_id: DNSSEC key ID for delete_key keyset: Keyset dict for import_keyset

Returns: DNSSEC operation result

Examples: - manage_dnssec(action="sign", zone_ids=["dns/auth_zone/abc", "dns/auth_zone/def"]) - manage_dnssec(action="unsign", zone_ids=["dns/auth_zone/abc"]) - manage_dnssec(action="status", zone_id="dns/auth_zone/abc") - manage_dnssec(action="export_trust_anchors", zone_ids=["dns/auth_zone/abc"]) - manage_dnssec(action="delete_key", zone_id="dns/auth_zone/abc", key_id="dns/auth_zone/abc/dnssec_key/k123") - manage_dnssec(action="import_keyset", zone_id="dns/auth_zone/abc", keyset={"keys": [...]})

Update, delete, list, or get existing DNS records. Supports smart lookup by name+zone+type. USE THIS for record lifecycle after creation. For creating new records use provision_dns() (or call this with action="create" — it routes there automatically and explains why). For zone management use manage_dns_zone().

Args: action: Operation to perform on the record record_id: DNS record ID (optional — can look up by name+zone+type) zone: DNS zone FQDN for filtering/lookup view: Optional DNS view name or ID. Required when a zone exists in multiple views (e.g., "default", "Azure.private-2") record_type: Record type filter — "A", "AAAA", "CNAME", "MX", "TXT", "PTR", "SRV", "NS" name: Record name for lookup (e.g., "www" or "www.example.com") rdata: New rdata for update (e.g., {"address": "10.0.0.1"} for A record) ttl: New TTL for update comment: New comment for update dry_run: If True (default), delete shows record details only. Set False to execute. limit: Max records for list (default: 50)

Returns: Record operation result

Examples: - manage_dns_record(action="list", zone="example.com") → all records in zone - manage_dns_record(action="list", zone="example.com", record_type="A") → A records only - manage_dns_record(action="get", record_id="dns/record/abc123") - manage_dns_record(action="update", record_id="dns/record/abc123", rdata={"address": "10.0.0.2"}) - manage_dns_record(action="delete", name="old-host", zone="example.com", record_type="A", dry_run=False)

Manage DHCP configuration: HA groups, option codes, hardware filters, option filters, hardware, DHCP servers, option groups/spaces, MAC address items, DHCP hosts, global config, and config profiles. USE THIS for DHCP-specific CRUD. For IP reservations use manage_ip_reservation(). For network topology use manage_network().

Args: resource_type: Type of DHCP resource to manage action: Operation to perform (bulk_create for mac_item; link/delink for config_profile) name: Resource name resource_id: Resource ID for get/update/delete mode: HA group mode (e.g., "active-active", "active-passive") — for ha_group create hosts: HA group hosts list — for ha_group create code: DHCP option code number — for option_code create option_type: Option code type (e.g., "string", "uint8") — for option_code create protocol: Protocol for hardware filters (e.g., "dhcpv4") — for hardware_filter create mac_address: MAC address — for hardware/mac_item create comment: Description items: List of MAC item dicts for bulk_create (each: {"mac": "AA:BB:CC:DD:EE:FF"}) object_id: Object ID for config_profile list/link/delink (e.g., subnet ID) tags: Resource tags dry_run: If True (default), delete shows resource only. Set False to execute.

Returns: DHCP operation result

Examples: - manage_dhcp(resource_type="ha_group", action="list") - manage_dhcp(resource_type="dhcp_server", action="list") - manage_dhcp(resource_type="option_group", action="create", name="my-group") - manage_dhcp(resource_type="mac_item", action="bulk_create", items=[{"mac": "AA:BB:CC:DD:EE:FF"}]) - manage_dhcp(resource_type="config_profile", action="link", resource_id="dhcp/config_profile/abc", object_id="ipam/subnet/xyz") - manage_dhcp(resource_type="dhcp_global", action="get") - manage_dhcp(resource_type="option_code", action="delete", resource_id="dhcp/option_code/123", dry_run=False)

Manage DHCP leases: list/search active leases, wipe leases, or resend DDNS updates. USE THIS for DHCP lease visibility and maintenance. For DHCP configuration use manage_dhcp().

IMPORTANT: "clear" permanently removes leases. Runs in dry_run mode by default for clear/resend_ddns. Set dry_run=False to actually execute destructive actions.

Args: action: Operation — list, get, clear (wipe lease), or resend_ddns address: IP address to filter/target mac_address: MAC address to filter (for list) hostname: Hostname to filter (for list) state: Lease state filter (e.g., "issued", "used") space: IP space name or ID (required for clear/resend_ddns to resolve address) resource_id: Lease resource ID for get dry_run: If True (default), clear/resend_ddns show what would happen. Set to False to execute. limit: Max results for list (default 100)

Returns: Lease operation result

Examples: - manage_dhcp_lease(action="list") → all active leases - manage_dhcp_lease(action="list", mac_address="AA:BB:CC:DD:EE:FF") - manage_dhcp_lease(action="get", resource_id="dhcp/lease/abc123") - manage_dhcp_lease(action="clear", address="10.0.0.50", space="prod") - manage_dhcp_lease(action="resend_ddns", address="10.0.0.50", space="prod")

Reserve, release, list, get, or update fixed IP addresses and DHCP static leases. USE THIS for IP reservation CRUD. For network topology use manage_network(). For IP conflicts use diagnose_ip_conflict().

IMPORTANT: Release runs in dry_run mode by default — shows host associations before releasing.

Args: action: Operation to perform on IP reservations address: IP address to reserve/release (e.g., "10.20.3.50") space: IP space name or ID (required for reserve) mac: MAC address to bind to reservation hostname: Hostname for the reservation comment: Description resource_id: Fixed address resource ID for get/update/release dry_run: If True (default), release shows associations only. Set False to execute.

Returns: Reservation operation result

Examples: - manage_ip_reservation(action="reserve", address="10.20.3.50", space="prod", mac="AA:BB:CC:DD:EE:FF") - manage_ip_reservation(action="list", space="prod") → all reservations in space - manage_ip_reservation(action="release", address="10.20.3.50", dry_run=False) - manage_ip_reservation(action="update", resource_id="ipam/fixed_address/abc", comment="Updated")

Manage DNS security resources: policies (read-only), named lists, application filters, internal domains, access codes, and category filters. USE THIS for security policy CRUD. For posture assessment use assess_security_posture(). For threat investigation use investigate_threat().

NOTE: Security policies are read-only via API (list/get only). Named lists support full CRUD + partial item updates. Category filters use full replace (PUT) for updates — both name and categories are required.

Args: resource_type: Type of security resource to manage action: Operation to perform. "add_items" and "remove_items" are for named_list only — they add/remove domains from an existing list without replacing the entire list. name: Resource name resource_id: Resource ID for get/update/delete/add_items/remove_items items: List of domains/IPs for named lists or internal domain lists. For "add_items": items to add. For "remove_items": items to remove. categories: List of content category names — for category_filter create/update description: Description text list_type: Named list type (e.g., "custom_list") — for named_list create criteria: Application filter criteria — for app_filter create activation: Access code activation date (ISO 8601) — for access_code create expiration: Access code expiration date (ISO 8601) — for access_code create rules: Access code rules — for access_code create dry_run: If True (default), delete shows resource only. Set False to execute.

Returns: Security resource operation result

Examples: - manage_security_policy(resource_type="policy", action="list") → all security policies - manage_security_policy(resource_type="named_list", action="list") - manage_security_policy(resource_type="named_list", action="create", name="block-list", list_type="custom_list", items=["bad.com"]) - manage_security_policy(resource_type="named_list", action="update", resource_id="...", items=["bad.com", "evil.com"]) - manage_security_policy(resource_type="named_list", action="add_items", resource_id="...", items=["new-bad.com"]) - manage_security_policy(resource_type="named_list", action="remove_items", resource_id="...", items=["old-entry.com"]) - manage_security_policy(resource_type="category_filter", action="list") → all category filters - manage_security_policy(resource_type="category_filter", action="create", name="block-adult", categories=["Adult Content"]) - manage_security_policy(resource_type="category_filter", action="update", resource_id="123", name="block-adult", categories=["Adult Content", "Malware"]) - manage_security_policy(resource_type="internal_domains", action="create", name="corp-domains", items=["corp.local"])

Manage federated IPAM: realms, blocks, delegations, pools, overlapping blocks, reserved blocks, and forward delegations. USE THIS for federated/multi-site IPAM operations. For local IPAM use manage_network(). For IP reservations use manage_ip_reservation().

Args: resource_type: Type of federation resource to manage action: Operation to perform ("allocate_next" only for blocks) name: Resource name (for realms, pools) resource_id: Resource ID for get/update/delete address: CIDR address for blocks/delegations realm: Federated realm name or ID cidr: CIDR prefix length for allocate_next delegated_to: Delegation target identifier comment: Description dry_run: If True (default), delete shows resource only. Set False to execute.

Returns: Federation operation result

Examples: - manage_federation(resource_type="realm", action="list") - manage_federation(resource_type="realm", action="create", name="region-us-east") - manage_federation(resource_type="block", action="create", address="10.0.0.0/8", realm="region-us-east") - manage_federation(resource_type="block", action="allocate_next", resource_id="federation/block/abc", cidr=24) - manage_federation(resource_type="delegation", action="create", address="10.1.0.0/16", realm="us-east", delegated_to="team-a")

Manage DNS Traffic Control (DTC/GSLB): LBDNs, pools, servers, and policies. USE THIS for global server load balancing and traffic steering. For DNS zones use manage_dns_zone(). For DNS records use manage_dns_record().

IMPORTANT: Delete runs in dry_run mode by default. LBDN is the primary resource; pools, servers, and policies are supporting configuration.

Args: resource_type: Type of DTC resource to manage action: Operation to perform name: Resource name (for create/update) resource_id: Resource ID for get/update/delete view: DNS view ID (for LBDN create) dtc_policy: DTC policy ID (for LBDN create) comment: Description dry_run: If True (default), delete shows resource only. Set False to execute.

Returns: DTC operation result

Examples: - manage_dtc(resource_type="lbdn", action="list") → all LBDNs - manage_dtc(resource_type="lbdn", action="create", name="app.example.com", view="dns/view/1", dtc_policy="dtc/policy/1") - manage_dtc(resource_type="pool", action="list") → all DTC pools - manage_dtc(resource_type="server", action="list") → all DTC servers - manage_dtc(resource_type="policy", action="list") → all DTC policies

Manage DNS-over-HTTPS (DoH) FQDNs, Point-of-Presence regions, threat feeds, threat indicators, and application/block approval lists.

Args: action: Operation to perform fqdn: DoH FQDN to create (for create_doh_fqdn) data: Raw payload dict for create_doh_fqdn or create_threat_indicator updates: Update payload for update_app_approvals / update_block_approvals

Returns: Operation result

Examples: - manage_doh(action="list_pop_regions") → list all PoP regions - manage_doh(action="create_doh_fqdn", fqdn="doh.example.com") → register DoH FQDN - manage_doh(action="list_threat_feeds") → list available threat feeds - manage_doh(action="create_threat_indicator", data={"type": "ip", "indicator": "1.2.3.4"}) - manage_doh(action="list_app_approvals") → list application approvals - manage_doh(action="update_app_approvals", updates={"approved": [...]}) - manage_doh(action="list_block_approvals") - manage_doh(action="update_block_approvals", updates={"blocked": [...]})

Triage security insights: update status, bulk triage by priority, or get comment history. USE THIS for incident response actions. For investigation use investigate_threat(). For posture review use assess_security_posture().

Args: action: Triage operation to perform insight_id: Single insight ID (for update_status, get_history) insight_ids: List of insight IDs (for bulk_triage; auto-populated from priority_filter if not set) status: New status for the insight(s) comment: Triage comment priority_filter: For bulk_triage — fetches matching open insights by priority dry_run: If True (default), bulk_triage shows what would be updated. Set False to execute.

Returns: Triage operation result

Examples: - triage_security_insight(action="get_history", insight_id="abc123") - triage_security_insight(action="update_status", insight_id="abc123", status="IN_PROGRESS", comment="Investigating") - triage_security_insight(action="bulk_triage", priority_filter="low", status="CLOSED", comment="Low priority batch close") - triage_security_insight(action="bulk_triage", insight_ids=["id1", "id2"], status="FALSE_POSITIVE", dry_run=False)