get_threat_incident
Retrieve full details of a security threat incident, including compromised package names, versions, and C2 domains/IPs. After listing incidents, use this to extract concrete IOCs and determine which exposure checks to run based on the ecosystem (npm or pypi).
Instructions
Get full details of one threat-center incident — including the 'Am I Affected?' markdown section which lists the EXACT compromised package names + versions and C2 IOCs (domains/IPs) to check. Call this after list_threat_incidents to extract the concrete things to search for. The incident's ecosystem field ('npm' or 'pypi') dictates which exposure tools to call: for npm → check_npm_package_exposure + check_npm_package_on_dev_machines. For pypi → check_pypi_package_exposure + check_python_package_on_dev_machines. Always also call check_ioc_in_baseline for each C2 domain/IP mentioned, regardless of ecosystem.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| owner | Yes | GitHub organization | |
| incidentId | Yes | Incident UUID from list_threat_incidents |