list_blocked_domain_calls
Get blocked outbound network call detections from Harden-Runner egress policy enforcement. Filter by status, customer, or GitHub org. Each result provides a clickable dashboard URL for investigation.
Instructions
List detections where Harden-Runner actively BLOCKED an outbound network call (egress-policy enforcement). Different from anomalous calls: blocked = the call was prevented; anomalous = the call happened but wasn't in baseline. Every result has a dashboard_url — when you present detections to the user you MUST include a clickable link per detection, not just the first one.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| customer | No | StepSecurity customer/tenant identifier. Optional — if omitted, falls back to STEP_SECURITY_CUSTOMER env var. Returns detections aggregated across ALL GitHub orgs installed under this tenant. | |
| status | No | Detection status filter. Defaults to 'new'. | |
| limit | No | Max detections to return (1-200). Defaults to 50. | |
| orgScope | No | Optional: restrict to a single GitHub org under this tenant (uses the owner-scoped endpoint instead of tenant-wide). |