ingest_detection
Ingest security detections from external scanners, SIEMs, or audit tools by providing source, severity, and affected resource information.
Instructions
Ingest a security detection from an external tool (scanner, SIEM, etc.).
Args: source: Detection source (e.g. "vulnerability_scanner", "config_audit"). severity: One of "critical", "high", "medium", "low", "info". affected_resource_type: Resource type (e.g. "ec2_instance", "pod"). affected_resource_id: Resource identifier. title: Detection title. cve: CVE identifier if applicable.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"source": "<source>",
"severity": "<severity>",
"affected_resource_type": "<affected_resource_type>",
"affected_resource_id": "<affected_resource_id>"
},
"name": "ingest_detection"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | ||
| severity | Yes | ||
| affected_resource_type | Yes | ||
| affected_resource_id | Yes | ||
| title | No | ||
| cve | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |