Search eSentire Findings (detections/alerts) for a date range.

This is the API behind the Findings table in the Atlas platform.

POST variant of the Findings search, for filter payloads too large for a query string.

Update an existing Finding (WRITE).

List the valid case_type / case_subtype / service combinations.

Always call this before creating a case. The taxonomy is server-driven and changes without notice, so hardcoding subtypes leads to rejected creates.

List cases from eSentire's ticketing system.

Get one case in full.

Create a new case in eSentire's ticketing system (WRITE -- reaches the real SOC).

This opens a genuine support case with eSentire. Confirm intent with a human before calling it. Validate case_type/case_subtype/service against tickets_case_type_configs first; invalid combinations are rejected.

Update a case: add comments, set customer fields, or resolve it (WRITE).

Resolving is reversible; closing is not. Prefer resolve.

List all comments on a case.

The case object itself only carries the latest 5 comments; use this for the rest.

List the email correspondence attached to a case.

List the file attachments on a case.

Fetch metadata or a download link for an attachment.

Atlas splits behaviour by size: files <= 5MB can come back inline, while files over 5MB return a link to secure cloud storage. This tool always requests JSON so you get metadata or a link rather than raw bytes -- binary content is not useful over MCP.

Attach a file to a case (WRITE).

Only handles the inline path, i.e. files <= 5MB. For anything larger, Atlas requires a two-step presigned upload that has to be driven from a real filesystem, not through an MCP tool call.

Delete an attachment from a case (WRITE -- not reversible).

List authorised contacts for your account.

Use this to get an exact contact value for tickets_create_case, since an unresolvable contact is silently dropped rather than rejected.

List locations registered for your account.

Same rationale as contacts: an unresolvable location is silently dropped.

Fetch the eSentire IP Watch blocklist.

Returns a newline-delimited list of malicious IP addresses, suitable for pushing into a firewall or WAF blocklist.

Check whether a specific IP address is on the eSentire IP Watch blocklist.

Fetch the most recent Indicator Bundles from the Threat Intelligence feed.

Covers IPs, domains, URLs, file hashes and email addresses curated by eSentire's Threat Response Unit. Upstream refreshes hourly, and results are cached for that long, so calling this repeatedly inside an hour returns identical data.

Page through Indicator Bundles from the Threat Intelligence feed.

Use this instead of ti_indicators when you need to walk the whole feed without blowing the response ceiling.

Fetch a MISP-format indicator file from the Threat Intelligence feed.

List discovered assets and their vulnerability counts.

Asset records use UPPERCASE field names (ASSET_ID, HOSTNAME, THREAT_RATING, VULN_CRITICAL_COUNT, ...). Note there are two parallel count families: SOFTWARE_VULN_*COUNT and VULN*_COUNT.

Get full detail for one asset.

List a sub-resource of one asset.

Get one vulnerability as it applies to one specific asset.

List the vulnerability catalogue across the whole estate.

Get details for one vulnerability, by internal id or by CVE.

List missing patches across the whole estate.

Find every asset affected by a given CVE, vulnerability, or missing patch.

This is the blast-radius question: given one finding, what is exposed? Supply exactly one of cve_id, vulnerability_id, or the patch_name/patch_type pair.