{"id":299937,"recorded_at":"2026-10-26T22:19:31.530533Z","observed_at":"2026-10-26T22:19:31.530472Z","subject_kind":"endpoint","subject":"a0683f7f-2f95-4d19-a87d-008901b7a4a4","kind":"mcp.tools","method":"probe.mcp/1","body":{"count":17,"tools":[{"description":"Generate kill chain for a TIBER-EU scenario with MITRE mapping.","inputSchema":{"additionalProperties":false,"properties":{"scenario_id":{"description":"TIBER-01 to TIBER-08","type":"string"}},"required":["scenario_id"],"type":"object"},"name":"attack_chain"},{"description":"Autonomous TLPT simulation: generates TIBER-EU scenarios, maps MITRE ATT&CK, creates findings, rates detection. Art. 26.","inputSchema":{"additionalProperties":false,"properties":{"entity_id":{"type":"string"},"scenarios":{"description":"Number of scenarios (default: 3)","type":"integer"}},"required":["entity_id"],"type":"object"},"name":"auto_simulate"},{"description":"Compile TLPT evidence for authority attestation.","inputSchema":{"additionalProperties":false,"properties":{"exercise_id":{"type":"string"}},"required":["exercise_id"],"type":"object"},"name":"evidence_bundle"},{"description":"Log a pentest/TLPT finding.","inputSchema":{"additionalProperties":false,"properties":{"attack_path":{"type":"string"},"detection_status":{"enum":["detected","partially_detected","undetected"],"type":"string"},"exercise_id":{"type":"string"},"mitre_technique":{"type":"string"},"recommendation":{"type":"string"},"severity":{"enum":["critical","high","medium","low"],"type":"string"},"system_affected":{"type":"string"},"title":{"type":"string"}},"required":["title","severity"],"type":"object"},"name":"finding_register"},{"description":"List all 8 TIBER-EU scenarios available for autonomous simulation.","inputSchema":{"additionalProperties":false,"properties":{},"type":"object"},"name":"generate_scenarios"},{"description":"Server status.","inputSchema":{"additionalProperties":false,"properties":{},"type":"object"},"name":"health_check"},{"description":"Map MITRE ATT&CK techniques to DORA TLPT. Filter by technique ID or tactic.","inputSchema":{"additionalProperties":false,"properties":{"tactic":{"type":"string"},"technique":{"type":"string"}},"type":"object"},"name":"mitre_map"},{"description":"TLPT obligations DORA-TST-06 to TST-10.","inputSchema":{"additionalProperties":false,"properties":{},"type":"object"},"name":"obligation_map"},{"description":"Track TIBER-EU 8-phase lifecycle.","inputSchema":{"additionalProperties":false,"properties":{"exercise_id":{"type":"string"},"phase_status":{"enum":["not_started","in_progress","completed","blocked"],"type":"string"},"update_phase":{"description":"Phase 1-8 to update","maximum":8,"minimum":1,"type":"integer"}},"required":["exercise_id"],"type":"object"},"name":"phase_tracker"},{"description":"Connectivity test.","inputSchema":{"additionalProperties":false,"properties":{},"type":"object"},"name":"ping"},{"description":"Register a TLPT/pentest exercise.","inputSchema":{"additionalProperties":false,"properties":{"authority_notified":{"type":"boolean"},"budget_eur":{"type":"number"},"exercise_id":{"type":"string"},"exercise_name":{"type":"string"},"notes":{"type":"string"},"red_team_provider":{"type":"string"},"scope":{"type":"string"},"start_date":{"type":"string"},"status":{"enum":["planned","in_progress","completed","cancelled"],"type":"string"},"target_end_date":{"type":"string"},"test_type":{"enum":["tlpt","red_team","vulnerability_scan","pentest","tabletop","scenario_based"],"type":"string"},"ti_provider":{"type":"string"}},"required":["exercise_name"],"type":"object"},"name":"register_exercise"},{"description":"Track remediation of TLPT findings. Set add=true to create.","inputSchema":{"additionalProperties":false,"properties":{"action":{"type":"string"},"add":{"type":"boolean"},"due_date":{"type":"string"},"exercise_id":{"type":"string"},"finding_id":{"type":"string"},"owner":{"type":"string"}},"type":"object"},"name":"remediation_plan"},{"description":"Push TLPT results to AmpelOracle Art. 26 checks.","inputSchema":{"additionalProperties":false,"properties":{"entity_id":{"type":"string"}},"required":["entity_id"],"type":"object"},"name":"sync_to_ampel"},{"description":"Manage Red/Blue/White/Purple team assignments.","inputSchema":{"additionalProperties":false,"properties":{"blue_team":{"type":"string"},"exercise_id":{"type":"string"},"purple_team":{"type":"string"},"red_team":{"type":"string"},"white_team":{"type":"string"}},"required":["exercise_id"],"type":"object"},"name":"team_assignment"},{"description":"Annual testing schedule and compliance check.","inputSchema":{"additionalProperties":false,"properties":{"year":{"type":"string"}},"type":"object"},"name":"test_calendar"},{"description":"Define threat landscape for TLPT scoping.","inputSchema":{"additionalProperties":false,"properties":{"attack_scenarios":{"type":"string"},"critical_systems":{"type":"string"},"crown_jewels":{"type":"string"},"exclusions":{"type":"string"},"exercise_id":{"type":"string"},"geography":{"type":"string"},"sector":{"type":"string"},"threat_actors":{"type":"string"}},"required":["exercise_id"],"type":"object"},"name":"threat_profile"},{"description":"Assess organizational readiness for a TLPT exercise.","inputSchema":{"additionalProperties":false,"properties":{"authority_engaged":{"type":"boolean"},"budget_approved":{"type":"boolean"},"crown_jewels_identified":{"type":"boolean"},"legal_framework":{"type":"boolean"},"red_team_selected":{"type":"boolean"},"scope_defined":{"type":"boolean"},"ti_provider_selected":{"type":"boolean"},"white_team_formed":{"type":"boolean"}},"type":"object"},"name":"tlpt_readiness"}]},"body_sha256":"2b9e1111f22335fa673cfe764aa2ae19292afe94399efb05c82f8e5152c3bea8","prev_id":null,"leaf":"0x38f5cd727b315cb6593bc890cb698cc21bf9daf8297dd7fb2ddd744d40233f33","leaf_text":"{\"body\":\"2b9e1111f22335fa673cfe764aa2ae19292afe94399efb05c82f8e5152c3bea8\",\"id\":299937,\"kind\":\"mcp.tools\",\"method\":\"probe.mcp/1\",\"observed_us\":1793053171530472,\"prev\":null,\"subject\":\"a0683f7f-2f95-4d19-a87d-008901b7a4a4\",\"subject_kind\":\"endpoint\"}","day":{"day":"2026-10-26","leaves":296695,"root":"0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8","chained":"0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a","anchor_chain":"eip155:5042002","anchor_tx":"0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae","anchor_block":69251483},"proof":["0x38f64fe1a0858f22fa6c50f0971be62dfff3da886cf6b1adcf92703428e0db7a","0x7adb2e756308313408b7b5aacbf96f0a149312c132190dfd469f217cb2e4c821","0xd154413f06a98a087f19a697f170950b38442603e16a341e939f8db0f3544cc5","0xf4a1f7cb35093c8a2c71d6939b2c2a27da57d061cd13083a46a4f3757ffbed2a","0xd5bed6c7eac987babd8ec007500890c01da1e73246ca91a1a8f2c3e52ab7441d","0x6a9b7a29426978ce36c673f9efbc9ac04d8eb4801042adcf6532022fbb305d5d","0x4be3b2c162216c63c37c6ac8e411e14dab6e13381f0d02a522600f415526a46b","0x2158389797e2758c63985caebb0b0ba2dc25e352609683fc1d2eabca618ec443","0x40a3e6b5548e56eda5adbd064d1ad9678e86caf61eda9e6dce2a431459fa2d73","0x9f3071ed8f2d0f3fa297d8d2cbe6bc9d92b7f12cd4c3d713d5debd20d9bd5436","0x04a1aa6c1d916326b08791d1568a512f10ac6aaee806ec4073570b0a6b1b64af","0x18cc4431e4bbe45ee72defb9bb3318434364bf71c883055c6197fa7102ec601a","0xe2214b3d6a48396930d1739b02ea366de2aac5337c9b9ff2aff28cecf6518139","0x7f594f5609f388d64d3cda87b5631d393ee8300bb09bad71f150113a5886ee33","0x4b52a97f7a80ff7778a702b85267b8d2e5c93ce160942656435c29ae7be68bf4","0x2e6a32eb32761c210560e852405e2f865f958ddbe01027894f8b9c1b3433b9f0","0x9a83be955a206deb65b995adfd92c58fa31c95fbbf926bd199d300e70b08b26d","0x20704208aa6923d6b2450ef74ede87a6e0265d46447926038fe9506e9e154b2d","0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a"]}