sophos-central-mcp-server 0.1.6 → 0.1.7

package/README.md

@@ -128,6 +128,60 @@ TRANSPORT=http
 | `sophos_add_blocked_item` | Block an item by SHA256, path, or certificate signer |
 | `sophos_delete_blocked_item` | Remove a blocked item |
 
+### Investigation
+
+#### Cases
+
+| Tool | Description |
+|------|-------------|
+| `sophos_list_cases` | List investigation cases with pagination |
+| `sophos_get_case` | Get full case details |
+| `sophos_create_case` | Create a new self-managed investigation case |
+| `sophos_update_case` | Update case status, severity, assignee, or overview |
+| `sophos_list_case_detections` | List detections linked to a case |
+| `sophos_get_case_mitre_summary` | Get MITRE ATT&CK tactic/technique breakdown for a case |
+
+#### Detections
+
+Async API — start a query, poll for completion, then fetch results.
+
+| Tool | Description |
+|------|-------------|
+| `sophos_run_detections_query` | Start an async query for individual XDR/EDR detections |
+| `sophos_get_detections_run` | Poll the status of a detections query run |
+| `sophos_get_detections_results` | Fetch results from a completed detections query |
+| `sophos_run_detection_groups_query` | Start an async query for grouped detections |
+| `sophos_get_detection_groups_run` | Poll the status of a detection groups query run |
+| `sophos_get_detection_groups_results` | Fetch results from a completed detection groups query |
+
+#### SIEM Events
+
+| Tool | Description |
+|------|-------------|
+| `sophos_list_siem_events` | Stream security events via cursor-based pagination (last 24h) |
+| `sophos_list_siem_alerts` | Stream security alerts via cursor-based pagination (last 24h) |
+
+#### XDR Data Lake
+
+Async API — submit a SQL query against historical telemetry, poll for completion, then fetch results.
+
+| Tool | Description |
+|------|-------------|
+| `sophos_run_xdr_query` | Start an async SQL query against the Sophos Data Lake |
+| `sophos_get_xdr_query_run` | Poll the status of an XDR query run |
+| `sophos_get_xdr_query_results` | Fetch paginated results from a completed XDR query |
+
+#### Live Discover
+
+Async API — run OSquery SQL on live endpoints in real time. Rate limited to 10 runs/minute, 500/day.
+
+| Tool | Description |
+|------|-------------|
+| `sophos_list_live_discover_queries` | List available saved OSquery queries |
+| `sophos_run_live_discover_query` | Run a saved or ad hoc OSquery against live endpoints |
+| `sophos_get_live_discover_run` | Poll the status of a Live Discover query run |
+| `sophos_get_live_discover_results` | Fetch paginated results from a completed Live Discover run |
+
 ### Tenant context
 
 For **partner/org** callers, every tenant-scoped tool requires a `tenant_id` parameter. Use `sophos_list_tenants` first to discover available tenant IDs.
@@ -178,14 +232,15 @@ src/
 │   ├── directory.ts          # sophos_list_users, list_admins, list_roles
 │   ├── policies.ts           # sophos_list/get/clone/update_policy
 │   ├── groups.ts             # sophos_list/get/create/update/delete_endpoint_group, add/remove endpoints
-│   └── exclusions.ts         # sophos_list/add/delete exclusions, allowed items, blocked items
+│   ├── exclusions.ts         # sophos_list/add/delete exclusions, allowed items, blocked items
+│   ├── cases.ts              # sophos_list/get/create/update_case, list_case_detections, mitre_summary
+│   ├── detections.ts         # sophos_run/get/results for detections and detection-groups
+│   ├── siem.ts               # sophos_list_siem_events, sophos_list_siem_alerts
+│   ├── xdr.ts                # sophos_run/get/results for XDR Data Lake queries
+│   └── live-discover.ts      # sophos_list_queries, run/get/results for Live Discover
 └── types/sophos.ts           # Sophos API response types
 ```
 
-## Roadmap
-
-- **Phase 3 (Investigation)**: XDR Data Lake queries, Live Discover, detections, cases, SIEM events
-
 ## Security
 
 - Credentials are read from environment variables only, never logged

package/dist/index.js

@@ -23,6 +23,11 @@ import { registerDirectoryTools } from "./tools/directory.js";
 import { registerPolicyTools } from "./tools/policies.js";
 import { registerGroupTools } from "./tools/groups.js";
 import { registerExclusionTools } from "./tools/exclusions.js";
+import { registerCaseTools } from "./tools/cases.js";
+import { registerDetectionTools } from "./tools/detections.js";
+import { registerSiemTools } from "./tools/siem.js";
+import { registerXdrTools } from "./tools/xdr.js";
+import { registerLiveDiscoverTools } from "./tools/live-discover.js";
 async function main() {
     // Load and validate config
     const config = loadConfig();
@@ -41,7 +46,7 @@ async function main() {
     // Create the MCP server
     const server = new McpServer({
         name: "sophos-central-mcp-server",
-        version: "0.1.0",
+        version: "0.1.7",
     });
     // Register tools based on identity type
     console.error(`[sophos-mcp] Registering tools for ${identity.idType} caller...`);
@@ -58,6 +63,12 @@ async function main() {
     registerPolicyTools(server, sophosClient, tenantResolver);
     registerGroupTools(server, sophosClient, tenantResolver);
     registerExclusionTools(server, sophosClient, tenantResolver);
+    // Phase 3: Investigation tools
+    registerCaseTools(server, sophosClient, tenantResolver);
+    registerDetectionTools(server, sophosClient, tenantResolver);
+    registerSiemTools(server, sophosClient, tenantResolver);
+    registerXdrTools(server, sophosClient, tenantResolver);
+    registerLiveDiscoverTools(server, sophosClient, tenantResolver);
     console.error("[sophos-mcp] All tools registered.");
     // Start transport
     if (config.transport === "http") {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,4BAA4B;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,KAAK,UAAU,IAAI;IACjB,2BAA2B;IAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAEpE,kBAAkB;IAClB,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5E,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IAExD,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;IAE7C,2CAA2C;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,cAAc,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;IAED,yBAAyB;IACzB,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAEpE,wBAAwB;IACxB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,wCAAwC;IACxC,OAAO,CAAC,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,YAAY,CAAC,CAAC;IAEjF,wDAAwD;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9C,CAAC;IAED,8CAA8C;IAC9C,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACzD,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC5D,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC1D,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAE7D,kCAAkC;IAClC,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC1D,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACzD,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAE7D,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAEpD,kBAAkB;IAClB,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAiB,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExB,0CAA0C;IAC1C,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS,EAAE,YAAY;YAC3C,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,wBAAwB;IACxB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;QACjC,OAAO,CAAC,KAAK,CAAC,0DAA0D,IAAI,MAAM,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAiB;IACvC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAC3D,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,4BAA4B;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAErE,KAAK,UAAU,IAAI;IACjB,2BAA2B;IAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAEpE,kBAAkB;IAClB,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5E,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;IAExD,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;IAE7C,2CAA2C;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,cAAc,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;IAED,yBAAyB;IACzB,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IAEpE,wBAAwB;IACxB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,wCAAwC;IACxC,OAAO,CAAC,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,YAAY,CAAC,CAAC;IAEjF,wDAAwD;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjC,mBAAmB,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9C,CAAC;IAED,8CAA8C;IAC9C,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACzD,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC5D,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC1D,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAE7D,kCAAkC;IAClC,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC1D,kBAAkB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACzD,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAE7D,+BAA+B;IAC/B,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACxD,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAC7D,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACxD,gBAAgB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IACvD,yBAAyB,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;IAEhE,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAEpD,kBAAkB;IAClB,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAChC,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,MAAiB,EAAE,IAAY;IACpD,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExB,0CAA0C;IAC1C,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS,EAAE,YAAY;YAC3C,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QAEzC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,wBAAwB;IACxB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;QACjC,OAAO,CAAC,KAAK,CAAC,0DAA0D,IAAI,MAAM,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAiB;IACvC,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAC3D,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/tools/cases.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Tools: sophos_list_cases, sophos_get_case, sophos_create_case, sophos_update_case,
+ *        sophos_list_case_detections, sophos_get_case_mitre_summary
+ * Interact with the Sophos Cases API /cases/v1/cases
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { SophosClient } from "../client/sophos-client.js";
+import type { TenantResolver } from "../client/tenant-resolver.js";
+export declare function registerCaseTools(server: McpServer, client: SophosClient, tenantResolver: TenantResolver): void;
+//# sourceMappingURL=cases.d.ts.map

package/dist/tools/cases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cases.d.ts","sourceRoot":"","sources":["../../src/tools/cases.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAYnE,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,YAAY,EACpB,cAAc,EAAE,cAAc,GAC7B,IAAI,CAuWN"}

package/dist/tools/cases.js

@@ -0,0 +1,338 @@
+/**
+ * Tools: sophos_list_cases, sophos_get_case, sophos_create_case, sophos_update_case,
+ *        sophos_list_case_detections, sophos_get_case_mitre_summary
+ * Interact with the Sophos Cases API /cases/v1/cases
+ */
+import { z } from "zod";
+import { jsonResult, withErrorHandling } from "./helpers.js";
+// Cases API max page size is 50
+const CASES_MAX_PAGE_SIZE = 50;
+export function registerCaseTools(server, client, tenantResolver) {
+    // --- List Cases ---
+    server.registerTool("sophos_list_cases", {
+        title: "List Sophos Cases",
+        description: `List investigation cases from a Sophos Central tenant.
+
+Retrieves cases from the Cases API with optional pagination.
+
+Args:
+  - tenant_id (string, optional): Tenant ID. Required for partner/org callers.
+  - limit (number, optional): Results per page (1-50, default 50).
+  - page (number, optional): Page number (default 1).
+
+Returns:
+  Paginated list of cases with: id, name, type, severity, status, assignee, detectionCount, createdAt, updatedAt.`,
+        inputSchema: {
+            tenant_id: z
+                .string()
+                .uuid()
+                .optional()
+                .describe("Tenant ID. Required for partner/org callers."),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(CASES_MAX_PAGE_SIZE)
+                .optional()
+                .default(CASES_MAX_PAGE_SIZE)
+                .describe("Results per page (max 50)"),
+            page: z
+                .number()
+                .int()
+                .min(1)
+                .optional()
+                .default(1)
+                .describe("Page number (default 1)"),
+        },
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+    }, withErrorHandling(async ({ tenant_id, limit, page }) => {
+        const resolvedTenantId = tenantResolver.resolveTenantId(tenant_id);
+        const data = await client.tenantRequest(resolvedTenantId, "/cases/v1/cases", {
+            params: {
+                pageSize: String(limit),
+                page: String(page),
+            },
+        });
+        return jsonResult({
+            total: data.pages.total,
+            page: data.pages.current ?? page,
+            page_size: data.pages.size,
+            total_pages: data.pages.total,
+            cases: data.items.map(formatCase),
+        });
+    }));
+    // --- Get Case ---
+    server.registerTool("sophos_get_case", {
+        title: "Get Sophos Case",
+        description: `Get full details of a specific Sophos Central case by ID.
+
+Args:
+  - case_id (string): The case ID.
+  - tenant_id (string, optional): Tenant ID. Required for partner/org callers.
+
+Returns:
+  Full case details including name, severity, status, assignee, overview, detectionCount, createdAt, updatedAt.`,
+        inputSchema: {
+            case_id: z.string().uuid().describe("Case ID to retrieve"),
+            tenant_id: z
+                .string()
+                .uuid()
+                .optional()
+                .describe("Tenant ID. Required for partner/org callers."),
+        },
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+    }, withErrorHandling(async ({ case_id, tenant_id }) => {
+        const resolvedTenantId = tenantResolver.resolveTenantId(tenant_id);
+        const data = await client.tenantRequest(resolvedTenantId, `/cases/v1/cases/${case_id}`);
+        return jsonResult(formatCase(data));
+    }));
+    // --- Create Case ---
+    server.registerTool("sophos_create_case", {
+        title: "Create Sophos Case",
+        description: `Create a new self-managed investigation case in Sophos Central.
+
+Only self-managed cases can be created via the API.
+
+Args:
+  - tenant_id (string, optional): Tenant ID. Required for partner/org callers.
+  - name (string): Case name.
+  - severity (string): Case severity: "informational", "low", "medium", "high", "critical".
+  - status (string): Initial status: "new" or "investigating".
+  - initial_detection_id (string): ID of the detection that triggered this case.
+  - assignee (string, optional): Email address of the assignee.
+  - overview (string, optional): Case overview/description.
+
+Returns:
+  The created case object.`,
+        inputSchema: {
+            tenant_id: z
+                .string()
+                .uuid()
+                .optional()
+                .describe("Tenant ID. Required for partner/org callers."),
+            name: z.string().describe("Case name"),
+            severity: z
+                .enum(["informational", "low", "medium", "high", "critical"])
+                .describe("Case severity"),
+            status: z
+                .enum(["new", "investigating"])
+                .describe("Initial case status"),
+            initial_detection_id: z
+                .string()
+                .uuid()
+                .describe("ID of the detection that triggered this case"),
+            assignee: z
+                .string()
+                .email()
+                .optional()
+                .describe("Email address of the assignee"),
+            overview: z
+                .string()
+                .optional()
+                .describe("Case overview/description"),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: true,
+        },
+    }, withErrorHandling(async ({ tenant_id, name, severity, status, initial_detection_id, assignee, overview }) => {
+        const resolvedTenantId = tenantResolver.resolveTenantId(tenant_id);
+        const body = {
+            type: "investigation",
+            name,
+            severity,
+            status,
+            initialDetectionId: initial_detection_id,
+        };
+        if (assignee)
+            body.assignee = assignee;
+        if (overview)
+            body.overview = overview;
+        const data = await client.tenantRequest(resolvedTenantId, "/cases/v1/cases", { method: "POST", body });
+        return jsonResult(formatCase(data));
+    }));
+    // --- Update Case ---
+    server.registerTool("sophos_update_case", {
+        title: "Update Sophos Case",
+        description: `Update an existing self-managed case in Sophos Central.
+
+Only self-managed cases can be updated via the API. Supply only the fields to change.
+
+Args:
+  - case_id (string): The case ID to update.
+  - tenant_id (string, optional): Tenant ID. Required for partner/org callers.
+  - name (string, optional): New case name.
+  - severity (string, optional): New severity: "informational", "low", "medium", "high", "critical".
+  - status (string, optional): New status: "new", "investigating", "closed".
+  - assignee (string, optional): Email address of the new assignee.
+  - overview (string, optional): Updated case overview.
+
+Returns:
+  The updated case object.`,
+        inputSchema: {
+            case_id: z.string().uuid().describe("Case ID to update"),
+            tenant_id: z
+                .string()
+                .uuid()
+                .optional()
+                .describe("Tenant ID. Required for partner/org callers."),
+            name: z.string().optional().describe("New case name"),
+            severity: z
+                .enum(["informational", "low", "medium", "high", "critical"])
+                .optional()
+                .describe("New severity"),
+            status: z
+                .enum(["new", "investigating", "closed"])
+                .optional()
+                .describe("New status"),
+            assignee: z
+                .string()
+                .email()
+                .optional()
+                .describe("Email address of the new assignee"),
+            overview: z.string().optional().describe("Updated case overview"),
+        },
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+    }, withErrorHandling(async ({ case_id, tenant_id, name, severity, status, assignee, overview }) => {
+        const resolvedTenantId = tenantResolver.resolveTenantId(tenant_id);
+        const body = {};
+        if (name !== undefined)
+            body.name = name;
+        if (severity !== undefined)
+            body.severity = severity;
+        if (status !== undefined)
+            body.status = status;
+        if (assignee !== undefined)
+            body.assignee = assignee;
+        if (overview !== undefined)
+            body.overview = overview;
+        const data = await client.tenantRequest(resolvedTenantId, `/cases/v1/cases/${case_id}`, { method: "PATCH", body });
+        return jsonResult(formatCase(data));
+    }));
+    // --- List Case Detections ---
+    server.registerTool("sophos_list_case_detections", {
+        title: "List Sophos Case Detections",
+        description: `List the detections associated with a specific Sophos Central case.
+
+Args:
+  - case_id (string): The case ID.
+  - tenant_id (string, optional): Tenant ID. Required for partner/org callers.
+  - limit (number, optional): Results per page (1-50, default 50).
+  - page (number, optional): Page number (default 1).
+
+Returns:
+  Paginated list of detections: id, attackType, detectionRule, severity, sensorGeneratedAt, device, sensor.`,
+        inputSchema: {
+            case_id: z.string().uuid().describe("Case ID to list detections for"),
+            tenant_id: z
+                .string()
+                .uuid()
+                .optional()
+                .describe("Tenant ID. Required for partner/org callers."),
+            limit: z
+                .number()
+                .int()
+                .min(1)
+                .max(CASES_MAX_PAGE_SIZE)
+                .optional()
+                .default(CASES_MAX_PAGE_SIZE)
+                .describe("Results per page (max 50)"),
+            page: z
+                .number()
+                .int()
+                .min(1)
+                .optional()
+                .default(1)
+                .describe("Page number (default 1)"),
+        },
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+    }, withErrorHandling(async ({ case_id, tenant_id, limit, page }) => {
+        const resolvedTenantId = tenantResolver.resolveTenantId(tenant_id);
+        const data = await client.tenantRequest(resolvedTenantId, `/cases/v1/cases/${case_id}/detections`, {
+            params: {
+                pageSize: String(limit),
+                page: String(page),
+            },
+        });
+        return jsonResult({
+            case_id,
+            total: data.pages.total ?? data.pages.items ?? data.items.length,
+            page: data.pages.current ?? page,
+            page_size: data.pages.size,
+            detections: data.items,
+        });
+    }));
+    // --- Get Case MITRE ATT&CK Summary ---
+    server.registerTool("sophos_get_case_mitre_summary", {
+        title: "Get Case MITRE ATT&CK Summary",
+        description: `Get the MITRE ATT&CK tactics and techniques summary for a Sophos Central case.
+
+Provides a breakdown of ATT&CK tactics observed in the case detections, with associated techniques and counts.
+
+Args:
+  - case_id (string): The case ID.
+  - tenant_id (string, optional): Tenant ID. Required for partner/org callers.
+
+Returns:
+  MITRE ATT&CK summary with tactics, techniques, and detection counts.`,
+        inputSchema: {
+            case_id: z.string().uuid().describe("Case ID to get MITRE summary for"),
+            tenant_id: z
+                .string()
+                .uuid()
+                .optional()
+                .describe("Tenant ID. Required for partner/org callers."),
+        },
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+    }, withErrorHandling(async ({ case_id, tenant_id }) => {
+        const resolvedTenantId = tenantResolver.resolveTenantId(tenant_id);
+        const data = await client.tenantRequest(resolvedTenantId, `/cases/v1/cases/${case_id}/mitre-attack-summary`);
+        return jsonResult({ case_id, mitre_attack_summary: data });
+    }));
+}
+function formatCase(c) {
+    return {
+        id: c.id,
+        name: c.name,
+        type: c.type,
+        severity: c.severity,
+        status: c.status,
+        assignee: c.assignee ?? null,
+        overview: c.overview ?? null,
+        managed_by: c.managedBy ?? null,
+        detection_count: c.detectionCount ?? null,
+        tenant_id: c.tenant.id,
+        created_at: c.createdAt,
+        created_by: c.createdBy ?? null,
+        updated_at: c.updatedAt ?? null,
+        initial_detection_id: c.initialDetection?.id ?? null,
+    };
+}
+//# sourceMappingURL=cases.js.map

package/dist/tools/cases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cases.js","sourceRoot":"","sources":["../../src/tools/cases.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAE7D,gCAAgC;AAChC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B,MAAM,UAAU,iBAAiB,CAC/B,MAAiB,EACjB,MAAoB,EACpB,cAA8B;IAE9B,qBAAqB;IACrB,MAAM,CAAC,YAAY,CACjB,mBAAmB,EACnB;QACE,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EAAE;;;;;;;;;;kHAU+F;QAC5G,WAAW,EAAE;YACX,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,IAAI,EAAE;iBACN,QAAQ,EAAE;iBACV,QAAQ,CAAC,8CAA8C,CAAC;YAC3D,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,mBAAmB,CAAC;iBACxB,QAAQ,EAAE;iBACV,OAAO,CAAC,mBAAmB,CAAC;iBAC5B,QAAQ,CAAC,2BAA2B,CAAC;YACxC,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,OAAO,CAAC,CAAC,CAAC;iBACV,QAAQ,CAAC,yBAAyB,CAAC;SACvC;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,iBAAiB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QACrD,MAAM,gBAAgB,GAAG,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CACrC,gBAAgB,EAChB,iBAAiB,EACjB;YACE,MAAM,EAAE;gBACN,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;aACnB;SACF,CACF,CAAC;QACF,OAAO,UAAU,CAAC;YAChB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;YACvB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI;YAChC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC1B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,mBAAmB;IACnB,MAAM,CAAC,YAAY,CACjB,iBAAiB,EACjB;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE;;;;;;;gHAO6F;QAC1G,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAC1D,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,IAAI,EAAE;iBACN,QAAQ,EAAE;iBACV,QAAQ,CAAC,8CAA8C,CAAC;SAC5D;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,iBAAiB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACjD,MAAM,gBAAgB,GAAG,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CACrC,gBAAgB,EAChB,mBAAmB,OAAO,EAAE,CAC7B,CAAC;QACF,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CACH,CAAC;IAEF,sBAAsB;IACtB,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE;;;;;;;;;;;;;;2BAcQ;QACrB,WAAW,EAAE;YACX,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,IAAI,EAAE;iBACN,QAAQ,EAAE;iBACV,QAAQ,CAAC,8CAA8C,CAAC;YAC3D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACtC,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;iBAC5D,QAAQ,CAAC,eAAe,CAAC;YAC5B,MAAM,EAAE,CAAC;iBACN,IAAI,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;iBAC9B,QAAQ,CAAC,qBAAqB,CAAC;YAClC,oBAAoB,EAAE,CAAC;iBACpB,MAAM,EAAE;iBACR,IAAI,EAAE;iBACN,QAAQ,CAAC,8CAA8C,CAAC;YAC3D,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,KAAK,EAAE;iBACP,QAAQ,EAAE;iBACV,QAAQ,CAAC,+BAA+B,CAAC;YAC5C,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,QAAQ,EAAE;iBACV,QAAQ,CAAC,2BAA2B,CAAC;SACzC;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,iBAAiB,CACf,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,oBAAoB,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;QACxF,MAAM,gBAAgB,GAAG,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,IAAI,GAA4B;YACpC,IAAI,EAAE,eAAe;YACrB,IAAI;YACJ,QAAQ;YACR,MAAM;YACN,kBAAkB,EAAE,oBAAoB;SACzC,CAAC;QACF,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACvC,IAAI,QAAQ;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAEvC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CACrC,gBAAgB,EAChB,iBAAiB,EACjB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CACzB,CAAC;QACF,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC,CACF,CACF,CAAC;IAEF,sBAAsB;IACtB,MAAM,CAAC,YAAY,CACjB,oBAAoB,EACpB;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE;;;;;;;;;;;;;;2BAcQ;QACrB,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACxD,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,IAAI,EAAE;iBACN,QAAQ,EAAE;iBACV,QAAQ,CAAC,8CAA8C,CAAC;YAC3D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC;YACrD,QAAQ,EAAE,CAAC;iBACR,IAAI,CAAC,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;iBAC5D,QAAQ,EAAE;iBACV,QAAQ,CAAC,cAAc,CAAC;YAC3B,MAAM,EAAE,CAAC;iBACN,IAAI,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;iBACxC,QAAQ,EAAE;iBACV,QAAQ,CAAC,YAAY,CAAC;YACzB,QAAQ,EAAE,CAAC;iBACR,MAAM,EAAE;iBACR,KAAK,EAAE;iBACP,QAAQ,EAAE;iBACV,QAAQ,CAAC,mCAAmC,CAAC;YAChD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;SAClE;QACD,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,iBAAiB,CACf,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC3E,MAAM,gBAAgB,GAAG,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACzC,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACrD,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACrD,IAAI,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAErD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CACrC,gBAAgB,EAChB,mBAAmB,OAAO,EAAE,EAC5B,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAC1B,CAAC;QACF,OAAO,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC,CACF,CACF,CAAC;IAEF,+BAA+B;IAC/B,MAAM,CAAC,YAAY,CACjB,6BAA6B,EAC7B;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EAAE;;;;;;;;;4GASyF;QACtG,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;YACrE,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,IAAI,EAAE;iBACN,QAAQ,EAAE;iBACV,QAAQ,CAAC,8CAA8C,CAAC;YAC3D,KAAK,EAAE,CAAC;iBACL,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC;iBACN,GAAG,CAAC,mBAAmB,CAAC;iBACxB,QAAQ,EAAE;iBACV,OAAO,CAAC,mBAAmB,CAAC;iBAC5B,QAAQ,CAAC,2BAA2B,CAAC;YACxC,IAAI,EAAE,CAAC;iBACJ,MAAM,EAAE;iBACR,GAAG,EAAE;iBACL,GAAG,CAAC,CAAC,CAAC;iBACN,QAAQ,EAAE;iBACV,OAAO,CAAC,CAAC,CAAC;iBACV,QAAQ,CAAC,yBAAyB,CAAC;SACvC;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,iBAAiB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QAC9D,MAAM,gBAAgB,GAAG,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CACrC,gBAAgB,EAChB,mBAAmB,OAAO,aAAa,EACvC;YACE,MAAM,EAAE;gBACN,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;aACnB;SACF,CACF,CAAC;QACF,OAAO,UAAU,CAAC;YAChB,OAAO;YACP,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;YAChE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI;YAChC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAC1B,UAAU,EAAE,IAAI,CAAC,KAAK;SACvB,CAAC,CAAC;IACL,CAAC,CAAC,CACH,CAAC;IAEF,wCAAwC;IACxC,MAAM,CAAC,YAAY,CACjB,+BAA+B,EAC/B;QACE,KAAK,EAAE,+BAA+B;QACtC,WAAW,EAAE;;;;;;;;;uEASoD;QACjE,WAAW,EAAE;YACX,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;YACvE,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,IAAI,EAAE;iBACN,QAAQ,EAAE;iBACV,QAAQ,CAAC,8CAA8C,CAAC;SAC5D;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;KACF,EACD,iBAAiB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACjD,MAAM,gBAAgB,GAAG,cAAc,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,aAAa,CACrC,gBAAgB,EAChB,mBAAmB,OAAO,uBAAuB,CAClD,CAAC;QACF,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAa;IAC/B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC/B,eAAe,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI;QACzC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE;QACtB,UAAU,EAAE,CAAC,CAAC,SAAS;QACvB,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC/B,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;QAC/B,oBAAoB,EAAE,CAAC,CAAC,gBAAgB,EAAE,EAAE,IAAI,IAAI;KACrD,CAAC;AACJ,CAAC"}

package/dist/tools/detections.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Tools: sophos_run_detections_query, sophos_get_detections_run, sophos_get_detections_results,
+ *        sophos_run_detection_groups_query, sophos_get_detection_groups_run, sophos_get_detection_groups_results
+ * Async query API for individual detections and detection groups.
+ * Pattern: POST to start → GET to poll status → GET results when finished.
+ */
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import type { SophosClient } from "../client/sophos-client.js";
+import type { TenantResolver } from "../client/tenant-resolver.js";
+export declare function registerDetectionTools(server: McpServer, client: SophosClient, tenantResolver: TenantResolver): void;
+//# sourceMappingURL=detections.d.ts.map

package/dist/tools/detections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detections.d.ts","sourceRoot":"","sources":["../../src/tools/detections.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAQnE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,YAAY,EACpB,cAAc,EAAE,cAAc,GAC7B,IAAI,CAyWN"}