check_ioc_in_baseline
Check if a domain or IP indicator of compromise is present in the Harden-Runner baseline for a GitHub organization. Returns matching repos, workflows, and runs with clickable dashboard URLs for investigation.
Instructions
Search the Harden-Runner org baseline for a domain or IP indicator of compromise. Uses the server-side search query (case-insensitive substring) so only matching endpoints come over the wire. Returns which repos/workflows/runs contacted the endpoint; each observation has a dashboard_url — when presenting results you MUST include a clickable link per observation, not just the first one. For a tenant-wide search across every org under your customer, use find_endpoint_calls_in_tenant instead.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"owner": "<owner>",
"indicator": "<indicator>"
},
"name": "check_ioc_in_baseline"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| owner | Yes | GitHub organization | |
| indicator | Yes | Domain or IP substring to match against observed endpoints |