List containers secured by RAD Security with optional filtering by image name, image digest, namespace, cluster_id, or free text search

Get detailed information about a container secured by RAD Security

List Kubernetes clusters managed by RAD Security

Get detailed information about a specific Kubernetes cluster managed by RAD Security

Get list of identities for a specific Kubernetes cluster

Get detailed information about a specific identity in a Kubernetes cluster

Get k8s audit logs with information about users who shelled into a pod

List cloud resources for a specific provider with optional filtering

Get detailed information about a specific cloud resource

Get available facets for filtering cloud resources from a provider

Get values for a specific facet from a cloud provider

List all compliance frameworks available for cloud resources (e.g., CIS, SOC2, PCI-DSS)

List all requirements for a specific compliance framework

List controls associated with a specific requirement within a compliance framework

List all compliance control summaries for the account

Get detailed information about a specific compliance control

List cloud resources associated with a specific compliance control

List container images with optional filtering by page, page size, sort, and search query

List vulnerabilities in a container image with optional filtering by severity

Get the most vulnerable images from your account

Get the SBOM of a container image

Get the latest manifest of a Kubernetes resource

List Kubernetes resources with optional filtering by namespace, resource types, and cluster

Get manifest misconfigurations for a Kubernetes resource

Get detailed information about a specific Kubernetes resource misconfiguration

List available misconfiguration policies used by RAD Security to detect Kubernetes resource misconfigurations

Get process trees for multiple containers

Get runtime baselines for multiple containers

Get LLM analysis of a container's process tree

List HTTP requests insights with optional filtering by method, path, source and destination workloads, and PII detection

List network connections with optional filtering

List network connection sources with optional filtering by source and destination workloads

List threat vectors

List security findings with optional filtering by types, severities, sources, and status

Update the status of a security finding

Get a list of all vendors in the CVE database. Source: cve-search.org

Get a list of all products associated with a vendor in the CVE database. Source: cve-search.org

Search CVEs by vendor and optionally product. Source: cve-search.org

Get details for a specific CVE ID. Source: cve-search.org

Get the latest/newest 30 CVEs including CAPEC, CWE and CPE expansions. Source: cve-search.org

Mark an inbox item as a false positive with a reason

List inbox items with optional filtering by any field. Multiple filters can be combined eg. 'search:cve-2024-12345 and severity:high'

Get detailed information about a specific inbox item

List all workflows

Get detailed information about a specific workflow by ID. It contains the workflow definition, default arguments, and schema how to run the workflow

List workflow runs with optional filtering by workflow ID

Get detailed information about a specific workflow run

Run a workflow with optional argument overrides

List workflow schedules with optional filtering by workflow ID

Search your organization's knowledge base to find relevant uploaded documents, procedures, reports, and other content using natural language queries

List all collections in your organization's knowledge base. Collections are used to organize and categorize documents

List documents in your organization's knowledge base with optional filtering by collections, file type, or status

Query a CSV document from the knowledge base using natural language. IMPORTANT: This tool ONLY works with CSV documents. Use list_knowledge_base_documents with filters='file_type:csv' to find CSV document IDs (search_knowledge_base results also contain document IDs). Results are returned as a markdown table

List all available RadQL data types (discovery). ALWAYS call this FIRST before using other RadQL tools to discover what data is available to query. Returns data types like 'containers', 'kubernetes_resources', 'inbox_items', 'vulnerabilities', etc. with descriptions.

Get schema/metadata for a specific RadQL data type. Shows available fields, data types, which fields can be filtered/searched, and provides query examples. Call this AFTER radql_list_data_types to understand how to query a specific data type.

List possible values for a filter field (e.g., namespace list, cluster list, severity values). Useful for building dynamic filters when you need to know available enum-like values. Call this when constructing filters that need specific values.

Execute RadQL queries for security investigations. Supports: list (filter/search), get_by_id (single item), stats (aggregations).

WORKFLOW: radql_list_data_types -> radql_get_type_metadata -> radql_query

COMMON FIELDS BY DATA TYPE: containers: name, image_name, image_repo, owner_kind, cluster_id, created_at Example: image_name:nginx AND owner_kind:Pod

finding_groups: type, source_kind, source_name, rule_title, severity, event_timestamp Types: k8s_misconfiguration, k8s_audit_logs_anomaly, threat_vector Example: type:k8s_misconfiguration AND severity:critical

inbox_items: severity (High|Medium|Low), type, title, archived, false_positive, created_at Example: severity:High AND archived:false

kubernetes_resources: kind, name, namespace, cluster_id, owner_kind, created_at Example: kind:Deployment AND namespace:production

CRITICAL QUOTING RULES: MUST quote when value contains:

• Dates/timestamps: created_at>"2024-01-01" (NOT created_at>2024-01-01)

• Hyphens: cluster_id:"abc-123-def", name:"kube-system"

• UUIDs: id:"550e8400-e29b-41d4-a716-446655440000"

• Spaces: title:"my alert"

• Special chars: :, =, <, >, !, (, )

• Wildcards with hyphens: name:"kube-*"

OK to leave unquoted:

• Simple strings: status:active, kind:Pod

• Numbers: count:123

• Booleans: archived:true

• Simple wildcards: name:nginx*

For complete schema: call radql_get_type_metadata with target data_type

Helper tool to build RadQL queries programmatically from structured conditions. Useful when you need to construct complex filter or stats queries from structured inputs.

Execute multiple RadQL queries in parallel for efficiency. Useful for fetching related data from different data types simultaneously (e.g., container details + vulnerabilities + network connections).

List widget templates with optional filtering by visualization type and category

Get detailed information about a specific widget template

List dashboard templates with optional filtering by category

Get detailed information about a specific dashboard template

List dashboards for the account

Get detailed information about a specific dashboard