{"tools":[{"name":"correlate","description":"Send the incident's raw SIEM events to the Correlate service and get back observations, relationships, and scored attack chains. Run this FIRST — everything else builds on its output."},{"name":"map_attack","description":"Map the correlated observations onto MITRE ATT&CK techniques and produce an ordered kill chain by tactic. Use to explain adversary progression."},{"name":"build_timeline","description":"Return the correlated observations in chronological order, optionally scoped to an entity id. Use to reconstruct the sequence of events."},{"name":"verify_claim","description":"Send a factual claim about the incident to the Evidence service for verification, attaching correlated observations/relationships as evidence. Returns a verdict (SUPPORTED / UNSUPPORTED / …) with per-rule checks and a signed digest. Use to validate the key conclusion."}],"dependencies":[{"name":"correlate","mode":"remote","target":"https://correlate.platphormnews.com"},{"name":"evidence","mode":"remote","target":"https://evidence.platphormnews.com"},{"name":"attack","mode":"local-engine","target":"local mapping engine"}]}