Fetch full summaries for multiple tickets in a single call. Each summary includes ticket details, all conversations, and attachment list. Use this instead of calling get_ticket_summary repeatedly — it fetches all tickets in parallel server-side, which is significantly faster. Typical workflow: 1. search_tickets or list_tickets → get list of ticket IDs 2. batch_get_ticket_summaries with those IDs → get all summaries at once Returns array of summaries in the same format as get_ticket_summary.

Search Freshdesk agents by name or email. Returns agent_id which can be passed to search_tickets agent_id to find tickets assigned to that agent.

Search Freshdesk companies by name. Returns company_id which can be used in search_tickets to find all tickets from a specific organisation. Example: find_company query='Defence' then search_tickets company_id=.

Scan multiple tickets at once and return all image attachments (png, jpg, jpeg). Typical workflow: 1. search_tickets → get list of ticket IDs 2. find_image_attachments with those IDs → find screenshots 3. get_attachment_text on attachment_id → OCR the image

Search Freshdesk contacts by name or email. Returns requester_id which can then be passed to search_tickets to find all tickets submitted by that person.

Extract text from a Freshdesk ticket attachment. Supported formats: - .docx: Word documents → plain text - .xlsx: Excel spreadsheets → tab-separated rows per sheet - .json: JSON files → pretty printed - .txt: plain text - .csv: CSV files → plain text - .png .jpg .jpeg: screenshots and images → OCR via Google Vision API Use list_attachments first to get the attachment_id. Ideal for reading investigation reports, domain lists, DNS screenshots and phishing page captures.

Get all replies, notes and email threads for a Freshdesk ticket. Returns body_text (plain text, HTML stripped), incoming=true means customer sent it, incoming=false means agent sent it. Use this to understand the full investigation history, analyst notes, and customer communications.

Extract and OCR inline images embedded in a ticket's description HTML body. Some tickets contain screenshots pasted directly into the description rather than uploaded as file attachments — these are not visible via list_attachments. Use this tool when get_ticket_summary shows a non-empty description but list_attachments finds no images, or when the description mentions a screenshot/table/log. Returns OCR text from each inline image found.

Retrieve a single Freshdesk support ticket by its numeric ID. Returns full details including id, subject, status, type, priority, due_by, is_escalated, created_at, tags and custom_fields (cf_impact, cf_urgency, cf_category, cf_subcategory, cf_domain).

Retrieve a complete summary of a Freshdesk ticket in one call: ticket details, all conversation replies and notes, and list of attachments. Use this as the first tool when investigating a specific ticket — it gives everything needed to understand the full context without multiple round trips. Returns: - ticket: id, subject, status, type, priority, due_by, is_escalated, custom_fields - conversations: all replies and notes with body_text and direction (incoming=customer, outgoing=agent) - attachments: list of files with id, name, content_type, size (use get_attachment_text to read them)

List all attachments on a Freshdesk ticket including files in conversation replies. Returns attachment id, name, content_type and size in bytes. Always call this before get_attachment_text, query_attachment or find_image_attachments to discover attachment IDs.

List all Freshdesk agent groups. Returns group id and name. Use this to find the group_id for filtering tickets by team. Example workflow: list_groups → find "Threat Intelligence" id → search_tickets group_id= Known groups:

Return all Freshdesk tickets with full fields for reporting and analysis. All filters are optional. Filters: - status: 2=open, 3=pending, 4=resolved, 5=closed - priority: 1=low, 2=medium, 3=high, 4=urgent - type: "False Positive", "False Negative", "Service Request", "Incident" - created_after / created_before: ISO8601 e.g. "2026-06-01T00:00:00Z" Use this for bulk analysis - e.g. all false positives this month, all high priority open tickets. For company or requester filtering use search_tickets instead.

Search within a JSON attachment on a Freshdesk ticket. Useful for finding specific domains or threat feeds in large JSON files.

Search and filter Freshdesk tickets. All fields are optional. Filters: - query: text matched against subject or type - status: 2=open, 3=pending, 4=resolved, 5=closed - priority: 1=low, 2=medium, 3=high, 4=urgent - type: "False Positive", "False Negative", "Service Request", "Incident" - overdue: true = tickets past due_by that are still open or pending - is_escalated: true = escalated tickets only - created_after / created_before: ISO8601 date e.g. "2026-06-01T00:00:00Z" - requester_id: from find_requester tool - company_id: from find_company tool Examples: Overdue tickets: {"overdue": true} Open false positives: {"type": "False Positive", "status": 2} High priority open: {"status": 2, "priority": 3} All tickets from Defence: first call find_company query="Defence", then use company_id