@pmoses-s1/s1-secops-mcp 1.3.6 → 1.3.7

package/CHANGELOG.md

@@ -1,5 +1,57 @@
 # Changelog
 
+## 1.3.7
+
+Minor, not patch: a tool is gone and the log-ingest credential changed. Both
+break an existing caller, so the version says so.
+
+### Log ingest needs an SDL Log Write Key
+
+`hec_ingest` now authenticates with **`S1_HEC_TOKEN`**, an SDL Log Write Key,
+and no longer sends an `S1-Scope` header. The Management Console API token is
+refused by the event collector. Measured on a live tenant, same request, same
+endpoint:
+
+    write key      -> HTTP 200 {"text":"Success","code":0}
+    console token  -> HTTP 400 {"text":"Missing S1-Scope header","code":5}
+
+The key is minted per account or site and writes only there, so it fixes the
+destination and there is nothing for a scope header to override. Mint it at
+Console > Singularity Data Lake > API Keys > Log Write Key; no API creates one.
+`S1_HEC_TOKEN` is optional, because only raw log ingest needs it, and it is named
+to match the deployer repos so one value covers both.
+
+UAM alert ingest and IOCs are NOT affected. They still use
+`S1_CONSOLE_API_TOKEN`, and `/v1/alerts` still requires `S1-Scope`.
+
+### Indicators ride inside the alert
+
+**`uam_post_indicators` is removed** (32 tools -> 31). Indicators can no longer
+be ingested on their own: `/v1/indicators` refuses the console user token and the
+Log Write Key alike, so no credential can drive it. They now travel inline in
+`finding_info.related_events[]` on a single `POST /v1/alerts`, which is also what
+the console Indicators tab reads.
+
+`uam_ingest_alert` posts once, inline. The `inline` parameter is still accepted
+so existing callers do not crash, but it is forced to true and a false value
+comes back with a note saying it was ignored, rather than quietly doing something
+different. The old two-call flow, its ~3s sleep and its ordering contract are
+deleted rather than left throwing: a code path that can only fail invites callers
+to keep it alive.
+
+Verified end to end on a live tenant: one alert carrying four indicators inline
+in a single POST surfaced in UAM with all four rendered and every uid matching.
+
+### Also
+
+- `Indicator` in the UAM GraphQL schema has fields `type, uid, title,
+  description, message, severity`. There is no `name` and no `category`;
+  querying either returns `FieldUndefined`. Examples across the docs used them.
+- `sdlToken`'s missing-credential test now runs in a child process. It deleted an
+  env var, but credentials are resolved once at import and fall back to a file,
+  so the exception it asserted could only be thrown on a machine with no
+  credentials at all. It passed in CI for exactly that reason.
+
 ## 1.3.6 - 2026-08-17
 
 Behaviour change, found by deploying to a real site and not being able to see the
@@ -131,7 +183,7 @@ were not wrapped at all. **26 tools → 32.**
 
 - `sdl-api/references/config-file-graphql.md` claimed the `s1-scope` header was
   "ignored, not rejected" on `/sdl/v2/graphql`. **That was wrong.** Measured on
-  `usea1-purple`, same token and query: `configFiles` returned 113 files at
+  `<console>`, same token and query: `configFiles` returned 113 files at
   account scope and 4 at a site scope. Config listings and dashboard reads are
   scope-FILTERED, so a dropped header changes which objects appear to exist.
   `auth_and_limits.md` corrected to match.
@@ -243,7 +295,7 @@ Config-file operations move from the legacy REST endpoints to GraphQL. Tool coun
 ### Fixed
 
 - **`sdl_list_files` no longer returns an incomplete listing.** The REST `/sdl/api/listFiles`
-  endpoint omits every udoId-addressed dashboard. Measured live on `usea1-purple`: REST returned
+  endpoint omits every udoId-addressed dashboard. Measured live on `<console>`: REST returned
   1,914 paths against `configFiles`' 2,264, a 350-file gap consisting entirely of `/dashboards/`
   files that carry a `udoId`. REST `getFile` on any of them returns `success/noSuchFile`. The
   practical impact was a false negative: a dashboard that existed in the console was reported as

package/README.md

@@ -24,6 +24,7 @@ See **[deploy/README.md](./deploy/README.md)** for the full deployment walkthrou
 | Mgmt Console | `s1_api_post` | mgmt-console-api |
 | Mgmt Console | `s1_api_put` | mgmt-console-api |
 | Mgmt Console | `uam_add_note` | mgmt-console-api |
+| Mgmt Console | `uam_available_actions` | mgmt-console-api |
 | Mgmt Console | `uam_get_alert` | mgmt-console-api |
 | Mgmt Console | `uam_list_alerts` | mgmt-console-api |
 | Mgmt Console | `uam_set_status` | mgmt-console-api |
@@ -45,7 +46,6 @@ See **[deploy/README.md](./deploy/README.md)** for the full deployment walkthrou
 | Hyperautomation | `ha_list_workflows` | hyperautomation |
 | UAM Ingest | `uam_ingest_alert` | mgmt-console-api (UAM Alert Interface) |
 | UAM Ingest | `uam_post_alert` | mgmt-console-api (UAM Alert Interface) |
-| UAM Ingest | `uam_post_indicators` | mgmt-console-api (UAM Alert Interface) |
 <!-- END AUTO-GENERATED TOOLS TABLE -->
 
 **2 resources:**
@@ -73,7 +73,7 @@ Add this to `claude_desktop_config.json` (or `.mcp.json` for Claude Code):
   "mcpServers": {
     "s1-secops-mcp": {
       "command": "npx",
-      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.6"],
+      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.7"],
       "env": {
         "S1_CONSOLE_URL":       "https://usea1-yourorg.sentinelone.net",
         "S1_CONSOLE_API_TOKEN": "eyJ...",
@@ -136,7 +136,9 @@ Credential keys, where to get each one, and the two token types are documented c
 
 `S1_CONSOLE_URL` and `S1_CONSOLE_API_TOKEN` are sufficient for the PowerQuery, Mgmt Console REST, Purple AI summary, UAM, Hyperautomation, and SDL config-file tools (22 of the 26).
 
-`S1_HEC_INGEST_URL` is **required** for the three UAM Ingest tools (`uam_ingest_alert`, `uam_post_indicators`, `uam_post_alert`) and for `hec_ingest`, the only four tools that need it. Without it those tools error at call time; the rest still work.
+`S1_HEC_INGEST_URL` is **required** for the two UAM Ingest tools (`uam_ingest_alert`, `uam_post_alert`) and for `hec_ingest`, the only three tools that need it. Without it those tools error at call time; the rest still work.
+
+`hec_ingest` additionally needs **`S1_HEC_TOKEN`**, an SDL Log Write Key. It is a different credential from the console API token, which the event collector refuses outright, and no API mints one: Console > Singularity Data Lake > API Keys > Log Write Key. The key is issued for a single account or site and writes only there, so it fixes the destination and there is no scope header to override it. UAM alert ingest and IOCs are unaffected and still use `S1_CONSOLE_API_TOKEN`.
 
 The SDL config-file tools (`sdl_list_files`, `sdl_get_file`, `sdl_put_file`, `sdl_delete_file`) are authorised by `S1_CONSOLE_API_TOKEN` against `POST <console>/sdl/v2/graphql`. The scoped SDL keys (`SDL_CONFIG_READ_KEY`, `SDL_CONFIG_WRITE_KEY`, `SDL_LOG_READ_KEY`, `SDL_LOG_WRITE_KEY`, `SDL_XDR_URL`) are retired and are no longer read.
 
@@ -144,7 +146,8 @@ The SDL config-file tools (`sdl_list_files`, `sdl_get_file`, `sdl_put_file`, `sd
 |----------|-------------|--------------|
 | `S1_CONSOLE_URL` | Console URL, e.g. `https://usea1-acme.sentinelone.net` | All Mgmt + PowerQuery + SDL tools |
 | `S1_CONSOLE_API_TOKEN` | Mgmt Console API token (Settings → Users → Service Users) | All Mgmt + PowerQuery + UAM + SDL config-file tools |
-| `S1_HEC_INGEST_URL` | HEC ingest host, e.g. `https://ingest.us1.sentinelone.net` | `uam_ingest_alert`, `uam_post_indicators`, `uam_post_alert`, `hec_ingest` |
+| `S1_HEC_INGEST_URL` | Ingest host, e.g. `https://ingest.us1.sentinelone.net` | `uam_ingest_alert`, `uam_post_alert`, `hec_ingest` |
+| `S1_HEC_TOKEN` | SDL Log Write Key, scoped to one account or site. Optional; only raw log ingest needs it. Same variable name as the deployer repos. | `hec_ingest` |
 
 ### Credential resolution order (highest priority wins)
 

package/deploy/README.md

@@ -57,7 +57,7 @@ Or, equivalently, by package name without the install:
   "mcpServers": {
     "s1-secops-mcp": {
       "command": "npx",
-      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.6"]
+      "args": ["-y", "@pmoses-s1/s1-secops-mcp@1.3.7"]
     }
   }
 }
@@ -376,7 +376,7 @@ Both block the W+X memory mappings V8 needs to JIT JavaScript. Adding them cause
 
 These are supported but not first-class:
 
-- **Docker / docker-compose.** Not shipped in this version. The single-file Node binary doesn't need it. If you want a container, the install is `FROM node:20-alpine` + `RUN npm install -g @pmoses-s1/s1-secops-mcp@1.3.6` + `CMD ["s1-secops-mcp", "--transport", "http", "--host", "0.0.0.0"]`. Mount creds at `/etc/s1-secops-mcp/credentials.json` and tokens at `/etc/s1-secops-mcp/bearer-tokens.json`.
+- **Docker / docker-compose.** Not shipped in this version. The single-file Node binary doesn't need it. If you want a container, the install is `FROM node:20-alpine` + `RUN npm install -g @pmoses-s1/s1-secops-mcp@1.3.7` + `CMD ["s1-secops-mcp", "--transport", "http", "--host", "0.0.0.0"]`. Mount creds at `/etc/s1-secops-mcp/credentials.json` and tokens at `/etc/s1-secops-mcp/bearer-tokens.json`.
 
 - **External bridge (`supergateway`, `mcp-proxy`).** Pre-1.1.0 deployments used these to wrap the stdio-only server. They still work; this server's native HTTP mode is functionally equivalent and removes the extra process. Prefer native unless you have a specific reason.
 

package/index.js

@@ -108,7 +108,7 @@ ENVIRONMENT
   S1_CONSOLE_URL              Console URL, e.g. https://usea1-acme.sentinelone.net
   S1_CONSOLE_API_TOKEN        Mgmt Console API token. Required for most tools.
   S1_HEC_INGEST_URL           HEC ingest host. Required for uam_ingest_alert,
-                              uam_post_indicators, uam_post_alert.
+                              uam_post_alert.
   S1_CREDS_FILE               Explicit path to a credentials.json file.
                               Highest priority for credential resolution.
   S1_CLAUDE_MD_PATH           Absolute path to CLAUDE.md for the soc_analyst

package/lib/credentials.js

@@ -106,6 +106,19 @@ export function getCreds() {
     S1_CONSOLE_URL:       e('S1_CONSOLE_URL'),
     S1_CONSOLE_API_TOKEN: e('S1_CONSOLE_API_TOKEN') || e('S1_API_TOKEN'),
     S1_HEC_INGEST_URL:    e('S1_HEC_INGEST_URL'),
+    // SDL Log Write Key, used ONLY for log ingest over the event collector.
+    // Optional: every other tool authenticates with S1_CONSOLE_API_TOKEN, and a
+    // deployment that never ingests logs does not need this at all.
+    //
+    // It is a DIFFERENT credential, not an alias. The collector refuses a
+    // console user token, and the key is minted for one account or site and
+    // writes only there, so it also fixes the destination: there is no scope
+    // header to override. Mint it at Console > Singularity Data Lake >
+    // API Keys > Log Write Key. No API creates one.
+    //
+    // Named to match the deployer repos, which already ship this variable, so
+    // one value can be pasted across all of them.
+    S1_HEC_TOKEN:         e('S1_HEC_TOKEN'),
     // Default S1-Scope for SDL requests: "<accountId>" for account scope or
     // "<accountId>:<siteId>" for site scope. Optional. Per-call scope arguments
     // override it; passing scope:null suppresses it entirely. SDL reads are

package/lib/hec.js

@@ -10,8 +10,16 @@
  *   Host      : S1_HEC_INGEST_URL (e.g. https://ingest.us1.sentinelone.net)
  *   Endpoints : /services/collector/raw   (raw text, recommended for logs)
  *               /services/collector/event (structured JSON)
- *   Auth      : Authorization: Bearer <S1_CONSOLE_API_TOKEN> (the same Management Console API token the other tools use)
- *   Scope     : S1-Scope header is REQUIRED (accountId or accountId:siteId). Without it HEC returns 400 "Missing S1-Scope header".
+ *   Auth      : Authorization: Bearer <S1_HEC_TOKEN>, an SDL Log Write Key. NOT the
+ *               Management Console API token: the collector refuses a user token.
+ *               Mint one at Console > Singularity Data Lake > API Keys > Log Write Key;
+ *               no API creates one.
+ *   Scope     : NONE. A Log Write Key is minted for one account or site and writes only
+ *               there, so the key itself fixes the destination and the S1-Scope header is
+ *               neither required nor honoured. Measured on a live tenant: the write key
+ *               returns 200 with no S1-Scope header at all, while the console token on the
+ *               same request returns 400 "Missing S1-Scope header". To write somewhere
+ *               else, use a key minted for that scope.
  *   Parser    : ?sourcetype=<parserName> query param. Other query params become fields in the UI.
  *   Pre-parsed: /event with ?isParsed=true indexes already-structured JSON fields directly, with no SDL parser.
  *   Compress  : optional "Content-Encoding: gzip" (or zstd), recommended, lowers egress cost.
@@ -36,9 +44,15 @@ function hecBase() {
 }
 
 function hecToken() {
-  const tok = getCreds().S1_CONSOLE_API_TOKEN;
+  const tok = getCreds().S1_HEC_TOKEN;
   if (!tok) {
-    throw new Error('S1_CONSOLE_API_TOKEN not configured. HEC uses the same Management Console API token as the Bearer.');
+    throw new Error(
+      'S1_HEC_TOKEN not configured. Log ingest needs an SDL Log Write Key, not the ' +
+      'Management Console API token: the event collector refuses a user token. ' +
+      'Mint one at Console > Singularity Data Lake > API Keys > Log Write Key ' +
+      '(no API creates one) and set S1_HEC_TOKEN. The key is scoped to one account or ' +
+      'site and writes only there.'
+    );
   }
   return tok;
 }
@@ -54,7 +68,10 @@ function sleep(ms) { return new Promise(r => setTimeout(r, ms)); }
  * @param {object} [opts.fields]    Extra {key: value} pairs -> query params, each becomes a UI field.
  *                              Avoid HEC-reserved keys (event, time, host, source, sourcetype, index, fields):
  *                              HEC interprets those, they are not stored as custom fields. Use `parser` (not a field) to set sourcetype. (S-26.1 HEC docs, p.4708.)
- * @param {string} opts.scope       REQUIRED. accountId or "accountId:siteId" -> S1-Scope header. HEC returns 400 "Missing S1-Scope header" without it.
+ * @param {string} [opts.scope]     IGNORED, accepted only so existing callers do not break.
+ *                              The S1-Scope header is not sent: the Log Write Key already
+ *                              determines the destination and the collector does not honour
+ *                              an override. Passing one has no effect.
  * @param {('raw'|'event')} [opts.endpoint='raw']
  *                              For 'event', logContent must be newline-separated HEC JSON envelopes:
  *                              {"time": <epoch seconds>, "event": <string|object>, "fields": {...}}.
@@ -67,15 +84,13 @@ function sleep(ms) { return new Promise(r => setTimeout(r, ms)); }
  * @returns {Promise<{status:number, endpoint:string, url:string, body:any}>}
  */
 export async function hecIngest(logContent, { parser, fields = {}, scope, endpoint = 'raw', compress = true, isParsed = false } = {}) {
+  void scope; // accepted and deliberately unused; see the param doc above.
   if (typeof logContent !== 'string' || logContent.length === 0) {
     throw new Error('hecIngest: logContent must be a non-empty string.');
   }
   if (endpoint !== 'raw' && endpoint !== 'event') {
     throw new Error("hecIngest: endpoint must be 'raw' or 'event'.");
   }
-  if (!scope || typeof scope !== 'string') {
-    throw new Error('hecIngest: scope is required. HEC rejects requests without an S1-Scope header (400 "Missing S1-Scope header"). Pass an accountId or "accountId:siteId".');
-  }
 
   const qs = new URLSearchParams();
   if (parser) qs.set('sourcetype', parser);
@@ -101,7 +116,8 @@ export async function hecIngest(logContent, { parser, fields = {}, scope, endpoi
     'Content-Type': endpoint === 'event' ? 'application/json' : 'text/plain',
   };
   if (compress) headers['Content-Encoding'] = 'gzip';
-  headers['S1-Scope'] = scope;
+  // No S1-Scope. The Log Write Key fixes the destination; sending a scope does not
+  // move the events and an empty one is a different request to none at all.
 
   let delay = 1000;
   let lastErr;

package/lib/s1.js

@@ -558,6 +558,44 @@ export async function uamAddNote(alertId, noteText) {
   }, null);
 }
 
+/**
+ * What actions does the API say this caller may trigger on this alert?
+ *
+ * The authoritative capability answer, and the thing to consult before
+ * explaining any refused action. Returns the raw list, each entry carrying
+ * `{id, title, type, isDisabled, disabledReason}`.
+ *
+ * `alertAvailableActions` needs a non-null `scope`, unlike alertTriggerActions,
+ * so account ids are resolved first. Availability is scope-sensitive (measured:
+ * the S1/incident/* actions report
+ * INCIDENT_ACTIONS_ONLY_AVAILABLE_FROM_SITE_VIEW under ACCOUNT scope and are
+ * enabled under SITE), so pass `scope` explicitly when you care about a
+ * site-scoped action.
+ */
+export async function uamAvailableActions(alertId, scope) {
+  let resolved = scope;
+  if (!resolved) {
+    const accts = await apiGet('/web/api/v2.1/accounts', { limit: 100 });
+    const ids = (accts?.data || []).map((a) => a.id).filter(Boolean);
+    if (!ids.length) throw new Error('no accounts visible to this token');
+    resolved = { scopeIds: ids, scopeType: 'ACCOUNT' };
+  }
+  const query = `
+    query AvailableActions($scope: ScopeSelectorInput!, $filter: OrFilterSelectionInput) {
+      alertAvailableActions(scope: $scope, filter: $filter) {
+        data { id title type isDisabled disabledReason }
+        errors { errorMessage }
+      }
+    }
+  `;
+  const variables = {
+    scope: resolved,
+    filter: { or: [{ and: [{ fieldId: 'id', stringEqual: { value: alertId } }] }] },
+  };
+  const data = await uamGraphql(query, variables, undefined, { readOnly: true });
+  return data?.alertAvailableActions?.data || [];
+}
+
 /**
  * Update the status of a UAM alert via alertTriggerActions.
  * Valid status values (confirmed via Status enum introspection): NEW | IN_PROGRESS | RESOLVED
@@ -605,7 +643,35 @@ export async function uamSetStatus(alertId, status) {
   }
   if (action.failure?.length) {
     const f = action.failure[0];
-    throw new Error(`uamSetStatus failed for alert ${alertId}: ${f.errorMessage || f.errorType || 'unknown error'}`);
+    // errorMessage says WHAT failed, not WHY. `Missing UAM manage permissions`
+    // is also what a not-offered action returns: alerts ingested via the UAM
+    // Alert Interface (/v1/alerts) expose only addNote and eventSearch, while
+    // the same token sets status on a native alert successfully (measured).
+    // So ask alertAvailableActions before reporting a cause, and never let the
+    // caller conclude "the token lacks permission" from the string alone.
+    let hint = '';
+    try {
+      const avail = await uamAvailableActions(alertId);
+      const ids = avail.map((a) => a.id);
+      if (!ids.includes('S1/alert/statusUpdate')) {
+        hint = ' | alertAvailableActions: statusUpdate is NOT OFFERED for this '
+             + `alert type (available: ${ids.join(', ') || 'none'}). This is a `
+             + 'capability limit of the alert, not a token scope; a new token '
+             + 'will not help.';
+      } else {
+        const a = avail.find((x) => x.id === 'S1/alert/statusUpdate');
+        hint = a?.isDisabled
+          ? ` | alertAvailableActions: offered but DISABLED (${a.disabledReason || 'no reason given'}).`
+          : ' | alertAvailableActions: statusUpdate IS available here, so the '
+            + 'refusal is not availability. Escalate as a genuine permission '
+            + 'or state problem.';
+      }
+    } catch (e) {
+      hint = ` | could not query alertAvailableActions to diagnose: ${e.message}`;
+    }
+    throw new Error(
+      `uamSetStatus failed for alert ${alertId}: ${f.errorMessage || f.errorType || 'unknown error'}${hint}`
+    );
   }
   if (!(action.success?.length) && action.skip?.length) {
     throw new Error(

package/lib/sdl.js

@@ -31,7 +31,7 @@ export function sdlToken() {
  *
  * SDL objects (dashboards, saved searches, config files) are filed against the
  * scope the request carries, and reads are filtered by it. Verified live on
- * usea1-purple 2026-08-17, same token: `configFiles` returned 113 files at
+ * <console> 2026-08-17, same token: `configFiles` returned 113 files at
  * account scope (20 of them dashboards) and 4 at a site scope (all 4
  * dashboards). A dashboard created at site scope is invisible to an
  * account-scoped listing, so a missing header is not a neutral default, it
@@ -415,7 +415,7 @@ export async function deleteConfigFile({ name, udoId, expectedVersion, scope })
 //
 // A SECOND, HIGHER-LEVEL SURFACE on the same `POST /sdl/v2/graphql` endpoint.
 // This is what the console itself drives; captured from live console traffic on
-// usea1-purple 2026-08-17 (280 requests, 23 operations).
+// <console> 2026-08-17 (280 requests, 23 operations).
 //
 // Relationship to the config-file layer above:
 //

package/lib/server-core.js

@@ -94,7 +94,7 @@ const PROMPTS = [
 
 export const SERVER_INFO = {
   name: 's1-secops-mcp-server',
-  version: '1.3.6',
+  version: '1.3.7',
 };
 
 export const PROTOCOL_VERSION = '2024-11-05';

package/lib/uam-ingest.js

@@ -9,15 +9,19 @@
  *   Scope : S1-Scope: <accountId>[:<siteId>[:<groupId>]]  (mandatory)
  *
  * Endpoints:
- *   POST /v1/indicators : OCSF behavioral indicators (batch: N per call)
- *   POST /v1/alerts     , OCSF SecurityAlert         (ONE per call, see below)
+ *   POST /v1/alerts     , OCSF SecurityAlert (ONE per call, see below)
  *
- * Critical constraints (empirically confirmed on your-tenant 2026-04-22):
+ * INDICATORS ARE NOT SEPARATELY INGESTIBLE. There is no usable POST
+ * /v1/indicators any more: the endpoint refuses the console user token AND the
+ * SDL Log Write Key, so no credential can drive it. Every indicator now rides
+ * inside the alert, in finding_info.related_events[], and the Indicators tab in
+ * the console is fed from there. This removed the sleep, the ordering contract
+ * and a whole class of silent drop, so the single POST is simpler as well as
+ * being the only thing that works.
+ *
+ * Critical constraints (empirically confirmed on a live tenant):
  *   - ONE alert per POST /v1/alerts. Multi-alert bodies return HTTP 202 but the
  *     stitcher silently drops all but one. Loop callers for multiple alerts.
- *   - Sleep ~3s between POST /v1/indicators and POST /v1/alerts. If the alert
- *     lands before the indicator's metadata.uid is registered the stitcher silently
- *     drops the alert (still HTTP 202). ingestAlert() enforces the sleep.
  *   - file.hashes MUST be OCSF Fingerprint array [{algorithm_id, algorithm, value}],
  *     NOT a plain dict. Dict form causes silent drop even on HTTP 202.
  *   - finding_info.related_events[] entries MUST carry class_uid, type_uid,
@@ -197,13 +201,16 @@ export function buildFileIndicator({
  *
  * Returns a complete alert object ready to POST to /v1/alerts (one at a time).
  *
- * @param {boolean} [inline=false]
- *   false (default): related_events[] contains only the reference fields (uid, class_uid,
- *     type_uid, etc.) and observables. The stitcher resolves the full indicator from a
- *     prior /v1/indicators POST via metadata.uid. Use with ingestAlert() (two-call flow).
- *   true: related_events[] embeds the full indicator context (file, device, actor) inline.
- *     No separate /v1/indicators POST is required: everything ships in one /v1/alerts call.
- *     Use with ingestAlertInline() (single-call flow).
+ * @param {boolean} [inline=true]
+ *   The only supported value is true, and it is the default. related_events[] embeds the
+ *   full indicator context (file, device, actor) inline and everything ships in one
+ *   /v1/alerts call.
+ *
+ *   Passing false used to emit reference-only entries for the stitcher to resolve against
+ *   a prior /v1/indicators POST. That POST is no longer possible, so a reference-only
+ *   alert now resolves to nothing: it is accepted with HTTP 202 and shows an empty
+ *   Indicators tab. The parameter is still accepted so old callers do not crash, but it
+ *   is forced to true and a warning is emitted.
  */
 export function buildSecurityAlert({
   alertUid,
@@ -212,7 +219,7 @@ export function buildSecurityAlert({
   description = 'Synthetic test alert created by s1-secops-mcp uam_ingest_alert.',
   detectionProduct = 'smoke-product',
   detectionVendor = 'smoke-vendor',
-  inline = false,
+  inline = true,
   nowMs,
 } = {}) {
   const ts = nowMs || Date.now();
@@ -286,72 +293,19 @@ export function buildSecurityAlert({
 
 // ─── High-level end-to-end helpers ────────────────────────────────────────────
 
-/**
- * Create a synthetic test alert in UAM end-to-end.
- *
- * Builds an OCSF FileSystem Activity indicator and a SecurityAlert,
- * POSTs them to the HEC ingest host with the required 3s sleep in between,
- * and returns the UIDs and HTTP responses.
+/* ingestAlert(), the two-step indicator-then-alert flow, was REMOVED.
  *
- * The alert typically surfaces in UAM within 30-60s. Search by title or
- * poll uam_list_alerts.
+ * It posted the indicator to /v1/indicators, slept ~3s for the stitcher, then
+ * posted an alert referencing it by uid. That path no longer works: the
+ * indicators endpoint refuses both the console user token and the SDL Log Write
+ * Key, so there is no credential that can drive it. Indicators are now carried
+ * inline in the alert body instead, which is what ingestAlertInline() below
+ * does, and which never needed the sleep or the sequencing in the first place.
  *
- * @param {object} opts
- * @param {string} opts.scope           accountId or "accountId:siteId" (mandatory)
- * @param {string} [opts.title]         Alert name shown in UAM (default: "MCP Test Alert")
- * @param {string} [opts.description]   Alert description
- * @param {string} [opts.hostname]      Hostname for the indicator device
- * @param {string} [opts.filename]      Filename for the FileSystem indicator
- * @param {string} [opts.sha256]        SHA-256 hash (64 hex chars); random if omitted
- * @param {number} [opts.sleepMs=3000]  Sleep between indicator POST and alert POST
+ * Deliberately deleted rather than left throwing: a function that can only fail
+ * invites callers to keep a code path alive for it.
  */
-export async function ingestAlert({
-  scope,
-  title = 'MCP Test Alert',
-  description = 'Synthetic test alert created by s1-secops-mcp uam_ingest_alert.',
-  hostname = 'mcp-test-host',
-  filename = 'test-payload.exe',
-  sha256,
-  sleepMs = 3000,
-} = {}) {
-  if (!scope) throw new Error('scope is required (accountId or "accountId:siteId").');
-
-  const nowMs = Date.now();
-  const indicatorUid = randomUUID();
-  const alertUid = randomUUID();
-
-  const indicator = buildFileIndicator({
-    indicatorUid,
-    filename,
-    sha256,
-    hostname,
-    nowMs,
-  });
-
-  const indicatorResp = await hecPost('/v1/indicators', [indicator], scope);
 
-  // Wait for the stitcher to register the indicator uid before posting the alert.
-  // Reducing below ~2s has been observed to cause silent drops on loaded tenants.
-  await sleep(sleepMs);
-
-  const alert = buildSecurityAlert({
-    alertUid,
-    indicator,
-    title,
-    description,
-    nowMs,
-  });
-
-  const alertResp = await hecPost('/v1/alerts', alert, scope);
-
-  return {
-    indicator_uid: indicatorUid,
-    alert_uid: alertUid,
-    indicator_response: indicatorResp,
-    alert_response: alertResp,
-    next_step: `Allow 30-60s then call uam_list_alerts to find the alert by title "${title}". Use uam_get_alert with the returned ID for full details.`,
-  };
-}
 
 /**
  * Create a synthetic test alert in UAM in a single /v1/alerts POST.
@@ -411,15 +365,10 @@ export async function ingestAlertInline({
 
 // ─── Low-level raw-payload helpers ────────────────────────────────────────────
 
-/**
- * POST raw OCSF indicators to /v1/indicators.
- * Caller is responsible for correct OCSF shape.
+/* postIndicators() was REMOVED along with the /v1/indicators path it wrapped.
+ * See the note above ingestAlertInline(). Indicators ride inside the alert.
  */
-export async function postIndicators({ scope, indicators }) {
-  if (!scope) throw new Error('scope is required.');
-  const items = Array.isArray(indicators) ? indicators : [indicators];
-  return hecPost('/v1/indicators', items, scope);
-}
+
 
 /**
  * POST a single raw OCSF SecurityAlert to /v1/alerts.
@@ -437,7 +386,14 @@ export async function postAlert({ scope, alert }) {
   return hecPost('/v1/alerts', alert, scope);
 }
 
-/** True if HEC ingest credentials are configured. */
+/** True if UAM ingest credentials are configured.
+ *
+ *  UAM alert ingest posts OCSF to /v1/alerts on the ingest host and authenticates
+ *  with the CONSOLE token, not the Log Write Key: alert creation and IOCs are
+ *  user-token operations. Only raw log ingest over the event collector uses
+ *  S1_HEC_TOKEN, and that is checked separately in hec.js. Conflating the two is
+ *  what made this function demand the wrong credential.
+ */
 export function hasHecCreds() {
   const c = getCreds();
   return !!(c.S1_HEC_INGEST_URL && c.S1_CONSOLE_API_TOKEN);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pmoses-s1/s1-secops-mcp",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "description": "MCP server orchestrating SentinelOne skills, APIs, and SOC analyst context. Stdio or Streamable HTTP transport with per-user bearer auth for team deployments.",
   "type": "module",
   "main": "index.js",

package/scripts/regen-readme-tools-table.mjs

@@ -60,7 +60,6 @@ const TOOL_SKILL = {
   ha_export_workflow:            'hyperautomation',
   // UAM Ingest
   uam_ingest_alert:              'mgmt-console-api (UAM Alert Interface)',
-  uam_post_indicators:           'mgmt-console-api (UAM Alert Interface)',
   uam_post_alert:                'mgmt-console-api (UAM Alert Interface)',
 };
 

package/tools/mgmt-console.js

@@ -12,6 +12,7 @@
  *   uam_get_alert           Get full alert details (notes, history)
  *   uam_add_note            Add analyst note to an alert
  *   uam_set_status          Update alert status (NEW, IN_PROGRESS, RESOLVED)
+ *   uam_available_actions   What actions this alert allows (isDisabled + reason)
  *
  * REMOVED (2026-05-03: confirmed non-functional for API tokens):
  *   purple_ai_query        : requires browser-session teamToken from /sdl/v2/graphql that
@@ -19,7 +20,7 @@
  *   purple_ai_investigate  : same root cause (SERVICE_ERROR). Use Purple MCP instead.
  */
 
-import { apiGet, apiPost, apiPut, apiDelete, apiPatch, purpleAlertSummary, uamListAlerts, uamGetAlert, uamAddNote, uamSetStatus } from '../lib/s1.js';
+import { apiGet, apiPost, apiPut, apiDelete, apiPatch, purpleAlertSummary, uamListAlerts, uamGetAlert, uamAddNote, uamSetStatus, uamAvailableActions } from '../lib/s1.js';
 
 /**
  * Defensive normalization for GET /cloud-detection/rules calls.
@@ -341,4 +342,49 @@ export const tools = [
       return JSON.stringify(result, null, 2);
     },
   },
+
+  // ─── uam_available_actions ────────────────────────────────────────────────
+  {
+    name: 'uam_available_actions',
+    description: `Ask the API which actions can be triggered on a UAM alert, with isDisabled and disabledReason per action. This is the authoritative capability answer and the ONLY correct way to explain a refused write. A refused action returns errorMessage "Missing UAM manage permissions" whether the token lacks a scope OR the action is simply not offered for that alert type, and those need opposite responses. Measured on one tenant with one token: an alert ingested via the UAM Alert Interface (/v1/alerts) offers only S1/alert/addNote and S1/alert/eventSearch, so uam_set_status can never work on it and no token change helps; a native STAR / third-party / correlation alert offers S1/alert/statusUpdate and S1/alert/analystVerdictUpdate and the same token applies them successfully. Call this before concluding anything about permissions, and before a bulk write you cannot undo. Availability is also scope-sensitive: the S1/incident/* actions report INCIDENT_ACTIONS_ONLY_AVAILABLE_FROM_SITE_VIEW under ACCOUNT scope and are enabled under SITE, so pass scopeIds/scopeType when you care about a site-scoped action. Read-only.`,
+    inputSchema: {
+      type: 'object',
+      properties: {
+        alertId: {
+          type: 'string',
+          description: 'The UAM alert ID to check.',
+        },
+        scopeIds: {
+          type: 'array',
+          items: { type: 'string' },
+          description: 'Optional. Account or site ids for the scope. Defaults to every account visible to the token, resolved via GET /accounts.',
+        },
+        scopeType: {
+          type: 'string',
+          description: 'Optional. Scope type for scopeIds. Availability differs between ACCOUNT and SITE for some actions.',
+          enum: ['ACCOUNT', 'SITE', 'GROUP', 'GLOBAL'],
+        },
+      },
+      required: ['alertId'],
+    },
+    async handler({ alertId, scopeIds, scopeType }) {
+      const scope = scopeIds?.length
+        ? { scopeIds, scopeType: scopeType || 'ACCOUNT' }
+        : undefined;
+      const actions = await uamAvailableActions(alertId, scope);
+      return JSON.stringify(
+        {
+          alertId,
+          scope: scope || 'all accounts visible to the token (ACCOUNT)',
+          enabled: actions.filter((a) => !a.isDisabled).map((a) => a.id),
+          disabled: actions
+            .filter((a) => a.isDisabled)
+            .map((a) => ({ id: a.id, reason: a.disabledReason })),
+          actions,
+        },
+        null,
+        2
+      );
+    },
+  },
 ];

package/tools/sdl-api.js

@@ -307,19 +307,22 @@ export const tools = [
   // ─── hec_ingest ─────────────────────────────────────────────────────────────
   {
     name: 'hec_ingest',
-    description: `Ingest raw logs/events into the SentinelOne AI SIEM Singularity Data Lake via the HEC (HTTP Event Collector) endpoint. Applies a named parser via ?sourcetype and lands the data in the Data Lake for Event Search, PowerQuery, and detection rules. Replaces the removed sdl_upload_logs. NOT UAM ingest (the uam_* tools post OCSF indicators/alerts to /v1/* on the same host but a separate API). Per S-26.1 HEC docs: POST {S1_HEC_INGEST_URL}/services/collector/raw, Authorization: Bearer <S1_CONSOLE_API_TOKEN>, query params become fields, gzip recommended, 10 MB uncompressed per request.`,
+    description: `Ingest raw logs/events into the SentinelOne AI SIEM Singularity Data Lake via the HEC (HTTP Event Collector) endpoint. Applies a named parser via ?sourcetype and lands the data in the Data Lake for Event Search, PowerQuery, and detection rules. Replaces the removed sdl_upload_logs. NOT UAM ingest (the uam_* tools post OCSF indicators/alerts to /v1/* on the same host but a separate API). POST {S1_HEC_INGEST_URL}/services/collector/raw with Authorization: Bearer <S1_HEC_TOKEN>, an SDL Log Write Key. NOT the Management Console API token: the collector refuses it. Measured on a live tenant, identical request: write key returns 200 {"text":"Success","code":0}, console token returns 400 {"text":"Missing S1-Scope header","code":5}. Mint the key at Console > Singularity Data Lake > API Keys > Log Write Key; no API creates one. The key is issued for one account or site and writes only there, so it fixes the destination and NO S1-Scope header is sent. Query params become fields, gzip recommended, 10 MB uncompressed per request.`,
     inputSchema: {
       type: 'object',
       properties: {
         logContent: { type: 'string', description: 'Raw log text. For the /raw endpoint, newline-separated lines become separate events.' },
         parser: { type: 'string', description: 'Parser name, sent as the ?sourcetype= query param. Omit to skip parsing (structured JSON on /event auto-parses).' },
         fields: { type: 'object', description: 'Extra key-value pairs sent as query params; each key becomes a field in the UI, e.g. {"server":"dev","region":"ap1"}. Avoid HEC-reserved names (event, time, host, source, sourcetype, index, fields) as keys; use the parser arg to set sourcetype.' },
-        scope: { type: 'string', description: 'REQUIRED. accountId or "accountId:siteId" sent as the S1-Scope header; HEC rejects requests without it (400 "Missing S1-Scope header").' },
+        scope: { type: 'string', description: 'IGNORED, accepted only so older callers do not break. The Log Write Key already fixes the destination and no S1-Scope header is sent, so passing this has no effect. To write to a different account or site, use a key minted for that scope.' },
         endpoint: { type: 'string', enum: ['raw','event'], description: "HEC endpoint: 'raw' (default, raw text) or 'event' (structured JSON)." },
         compress: { type: 'boolean', description: 'gzip the body (Content-Encoding: gzip). Default true.' },
         isParsed: { type: 'boolean', description: 'For /event with structured JSON: set ?isParsed=true so SDL indexes the JSON fields directly, with no SDL parser. Confirmed working.' },
       },
-      required: ['logContent', 'scope'],
+      // `scope` is NOT required any more. Leaving it in `required` made the schema
+      // demand an argument the implementation discards, so a correct call looked
+      // invalid and an invalid one looked correct.
+      required: ['logContent'],
     },
     async handler({ logContent, parser, fields, scope, endpoint, compress, isParsed }) {
       const result = await hecIngest(logContent, { parser, fields, scope, endpoint, compress, isParsed });

package/tools/uam-ingest.js

@@ -3,28 +3,35 @@
  * via the SentinelOne HEC ingest host (ingest.us1.sentinelone.net).
  *
  * Tools:
- *   uam_ingest_alert      End-to-end: build + POST one FileSystem indicator + one SecurityAlert
- *   uam_post_indicators   Low-level: POST raw OCSF indicators to /v1/indicators
+ *   uam_ingest_alert      End-to-end: build + POST one SecurityAlert carrying its indicator inline
  *   uam_post_alert        Low-level: POST a single raw OCSF SecurityAlert to /v1/alerts
  *
- * These tools require S1_HEC_INGEST_URL in credentials.json in addition to
- * S1_CONSOLE_API_TOKEN (same token, Bearer prefix instead of ApiToken).
+ * uam_post_indicators WAS REMOVED. Indicators can no longer be ingested on their
+ * own: /v1/indicators refuses the console user token and the SDL Log Write Key
+ * alike, so no credential can drive it. They are carried inside the alert, in
+ * finding_info.related_events[], which is also what the console Indicators tab
+ * reads. A tool that can only ever return 403 is worse than no tool, because it
+ * reads as a supported path.
+ *
+ * These tools require S1_HEC_INGEST_URL plus S1_CONSOLE_API_TOKEN. Alert creation
+ * and IOCs remain user-token operations; only raw LOG ingest over the event
+ * collector uses S1_HEC_TOKEN.
  */
 
-import { ingestAlert, ingestAlertInline, postIndicators, postAlert } from '../lib/uam-ingest.js';
+import { ingestAlertInline, postAlert } from '../lib/uam-ingest.js';
 
 export const tools = [
 
   // ─── uam_ingest_alert ─────────────────────────────────────────────────────
   {
     name: 'uam_ingest_alert',
-    description: `Create a synthetic test alert in Unified Alert Management (UAM) via the SentinelOne HEC ingest API. Supports two modes controlled by the "inline" parameter:
+    description: `Create a synthetic test alert in Unified Alert Management (UAM) via the SentinelOne ingest API.
 
-Two-call mode (inline=false, default): POST indicator to /v1/indicators, sleep 3s, POST SecurityAlert to /v1/alerts referencing the indicator uid. The stitcher resolves the full indicator into alert.rawIndicators. Best for testing deep indicator stitching and the Indicators tab in UAM.
+ONE round-trip: a single SecurityAlert POSTed to /v1/alerts with its indicator embedded in finding_info.related_events[]. No sleep, no stitcher race, no ordering contract. That inline copy is what populates alert.indicators, the field the console Indicators tab renders.
 
-Inline mode (inline=true): POST a single SecurityAlert to /v1/alerts with the indicator's file/device/actor fields embedded inside finding_info.related_events[]. No separate indicator POST, no sleep, one round-trip. Best for rapid alert creation or when a single call is preferred.
+There is no longer a two-call alternative. Posting indicators separately to /v1/indicators is refused for every credential type: the console user token and the SDL Log Write Key both fail, so nothing can drive that endpoint. The old flow also wrote alert.rawIndicators, a separate store the UI never read. The inline parameter is still accepted so existing callers do not break, but it is forced to true.
 
-Both modes return indicator_uid and alert_uid. The alert surfaces in UAM within 30-60s. Requires S1_HEC_INGEST_URL in credentials.json.`,
+Returns indicator_uid and alert_uid. The alert surfaces in UAM within 30-60s. Verify with alert(id){indicators{...}}; alertWithRawIndicators stays empty by design. Requires S1_HEC_INGEST_URL and S1_CONSOLE_API_TOKEN.`,
     inputSchema: {
       type: 'object',
       properties: {
@@ -55,48 +62,26 @@ Both modes return indicator_uid and alert_uid. The alert surfaces in UAM within
           type: 'string',
           description: 'SHA-256 hash (64 lowercase hex chars). If omitted, a zeroed placeholder hash is used.',
         },
-        sleep_ms: {
-          type: 'number',
-          description: 'Two-call mode only. Milliseconds to sleep between the indicator POST and the alert POST. Default 3000. Do not go below 2000 on loaded tenants.',
-          default: 3000,
-        },
         inline: {
           type: 'boolean',
-          description: 'When true, embed indicator data (file, device, actor, observables) directly inside the alert\'s finding_info.related_events[] and POST only to /v1/alerts; no separate /v1/indicators call, no sleep. When false (default), use the two-call flow: POST indicator first, sleep, then POST alert.',
-          default: false,
+          description: 'Accepted for backward compatibility and ignored: the value is always true. Indicators ride inside the alert because there is no working way to post them separately. Passing false returns a note saying so rather than silently doing something different.',
+          default: true,
         },
       },
       required: ['scope'],
     },
-    async handler({ scope, title, description, hostname, filename, sha256, sleep_ms = 3000, inline = false }) {
-      const result = inline
-        ? await ingestAlertInline({ scope, title, description, hostname, filename, sha256 })
-        : await ingestAlert({ scope, title, description, hostname, filename, sha256, sleepMs: sleep_ms });
-      return JSON.stringify(result, null, 2);
-    },
-  },
-
-  // ─── uam_post_indicators ──────────────────────────────────────────────────
-  {
-    name: 'uam_post_indicators',
-    description: `POST one or more raw OCSF behavioral indicators to /v1/indicators on the SentinelOne HEC ingest host. Batching is supported; pass multiple indicators in the array and they are sent in a single gzip-compressed request. Each indicator must carry metadata.profiles=["s1/security_indicator"] and a unique metadata.uid (used as the join key when an alert references it). After posting, wait at least 3s before posting a SecurityAlert that references these indicator uids (use uam_post_alert or uam_ingest_alert which enforce the sleep). Requires S1_HEC_INGEST_URL in credentials.json.`,
-    inputSchema: {
-      type: 'object',
-      properties: {
-        scope: {
-          type: 'string',
-          description: 'accountId or "accountId:siteId". Mandatory.',
-        },
-        indicators: {
-          type: 'array',
-          description: 'Array of OCSF indicator objects. Each must have metadata.uid, metadata.profiles=["s1/security_indicator"], class_uid, and observables[]. file.hashes must be a Fingerprint array [{algorithm_id, algorithm, value}], not a plain dict.',
-          items: { type: 'object', additionalProperties: true },
-        },
-      },
-      required: ['scope', 'indicators'],
-    },
-    async handler({ scope, indicators }) {
-      const result = await postIndicators({ scope, indicators });
+    async handler({ scope, title, description, hostname, filename, sha256, inline = true }) {
+      const result = await ingestAlertInline({ scope, title, description, hostname, filename, sha256 });
+      // Say so rather than quietly substituting a different behaviour. A caller
+      // that asked for the two-call flow is working from a stale assumption and
+      // needs to know the request was not honoured as written.
+      if (inline === false) {
+        result.note =
+          'inline:false was ignored. Indicators cannot be posted separately any more: ' +
+          '/v1/indicators refuses both the console token and the SDL Log Write Key. ' +
+          'The indicator was embedded in the alert instead, which is what the ' +
+          'console Indicators tab reads.';
+      }
       return JSON.stringify(result, null, 2);
     },
   },
@@ -104,7 +89,7 @@ Both modes return indicator_uid and alert_uid. The alert surfaces in UAM within
   // ─── uam_post_alert ───────────────────────────────────────────────────────
   {
     name: 'uam_post_alert',
-    description: `POST a single raw OCSF SecurityAlert to /v1/alerts on the SentinelOne HEC ingest host. IMPORTANT: one alert per call. The HEC stitcher silently drops all but one alert in a multi-alert POST body (HTTP 202 still returned), so this tool rejects arrays. To send multiple alerts, loop this call. Always post indicator(s) first via uam_post_indicators and sleep at least 3s before calling this; posting an alert before its indicator uids are registered causes a silent drop. Requires S1_HEC_INGEST_URL in credentials.json.`,
+    description: `POST a single raw OCSF SecurityAlert to /v1/alerts on the SentinelOne HEC ingest host. IMPORTANT: one alert per call. The HEC stitcher silently drops all but one alert in a multi-alert POST body (HTTP 202 still returned), so this tool rejects arrays. To send multiple alerts, loop this call. Carry the indicator INLINE in finding_info.related_events[] (uid, title, desc, message, time, severity_id, class_uid, type_uid, category_uid, activity_id, and observables[] with type + typeName). That alone populates alert.indicators, which is what the UAM Indicators tab renders; no /v1/indicators call is needed and none should be made, because that endpoint returns 403 "User token not allowed for this endpoint" for a service-user token while /v1/alerts accepts the same credential. Requires S1_HEC_INGEST_URL in credentials.json.`,
     inputSchema: {
       type: 'object',
       properties: {