Updates example questions for MCP
Refreshes example questions to better reflect common use cases and improve user experience. This change replaces outdated or less relevant example questions with new ones that address frequent user needs across different MCP server types.
taylor_socfortress committed
Jul 24, 2025 at 10:08 UTC
630e8d72a2699111e300f2d621f147ed247485a8
1 file changed
+22
-69
backend/app/integrations/copilot_mcp/services/example_questions.py
+22
-69
@@ -23,12 +23,12 @@ class ExampleQuestionsService:
23
category="alerts",
24
),
25
ExampleQuestion(
26
- question="Show me the latest critical alerts from the past 24 hours",
26
+ question="Show me spotted iocs for customerA",
27
description="Retrieve recent high-priority security alerts",
28
category="alerts",
29
),
30
ExampleQuestion(
31
- question="What are the top 5 most common alert types?",
31
+ question="What are the top 5 most common alert sources?",
32
description="Analyze alert patterns to identify frequent security events",
33
category="analytics",
34
),
@@ -38,9 +38,9 @@ class ExampleQuestionsService:
38
category="customers",
39
),
40
ExampleQuestion(
41
- question="Show me incident trends for the past week",
42
- description="Display incident statistics and trends over time",
43
- category="incidents",
41
+ question="Show me endpoint status for customerA",
42
+ description="Display endpoint status.",
43
+ category="endpoints",
44
),
45
],
46
MCPServerType.WAZUH_MANAGER: [
@@ -49,6 +49,11 @@ class ExampleQuestionsService:
49
description="Check the current operational status of a specific Wazuh agent",
50
category="agents",
51
),
52
+ ExampleQuestion(
53
+ question="What are the SCA findings for endpoint123?",
54
+ description="Retrieve the Software Composition Analysis (SCA) findings for a specific endpoint",
55
+ category="agents",
56
+ ),
57
ExampleQuestion(
58
question="What are the open ports on endpoint123?",
59
description="List all open network ports detected on a specific endpoint",
@@ -65,19 +70,9 @@ class ExampleQuestionsService:
70
category="agents",
71
),
72
ExampleQuestion(
68
- question="What are the latest security events from agent endpoint123?",
69
- description="Retrieve recent security events and alerts from a specific agent",
70
- category="security",
71
- ),
72
- ExampleQuestion(
73
- question="How many agents are currently online?",
74
- description="Get the count of active and connected Wazuh agents",
75
- category="agents",
76
- ),
77
- ExampleQuestion(
78
- question="What vulnerabilities were detected on endpoint123?",
79
- description="List security vulnerabilities found during scans",
80
- category="vulnerabilities",
73
+ question="Do I have any sysmon event 1 detection rules?",
74
+ description="Check for specific security rules related to Sysmon event 1",
75
+ category="rules",
76
),
77
],
78
MCPServerType.WAZUH_INDEXER: [
@@ -87,64 +82,29 @@ class ExampleQuestionsService:
82
category="health",
83
),
84
ExampleQuestion(
90
- question="How many documents are indexed today?",
85
+ question="What are the most critical vulnerabilities for `agent_name`: endpoint123?",
86
description="Get the count of new documents added to the index",
87
category="indexing",
88
),
94
- ExampleQuestion(
95
- question="What are the most frequent log sources?",
96
- description="Analyze which systems are generating the most log data",
97
- category="analytics",
98
- ),
99
- ExampleQuestion(
100
- question="Show me index storage usage statistics",
101
- description="Display disk usage and storage metrics for indices",
102
- category="storage",
103
- ),
104
- ExampleQuestion(
105
- question="What indices have the highest document count?",
106
- description="List indices sorted by number of documents",
107
- category="indexing",
108
- ),
109
- ExampleQuestion(
110
- question="Are there any failed index operations?",
111
- description="Check for indexing errors or failed operations",
112
- category="errors",
113
- ),
89
],
90
MCPServerType.VELOCIRAPTOR: [
91
ExampleQuestion(
117
- question="Show me all running processes on endpoint DESKTOP-ABC123",
118
- description="List all currently running processes on a specific endpoint",
119
- category="processes",
92
+ question="What users have logged onto endpoint123 in the last 30 days?",
93
+ description="List all users who have logged onto a specific endpoint within the last 30 days",
94
+ category="users",
95
),
96
ExampleQuestion(
122
- question="What files were created in the last 24 hours on endpoint DESKTOP-ABC123?",
123
- description="Find recently created files on a specific endpoint for forensic analysis",
124
- category="filesystem",
125
- ),
126
- ExampleQuestion(
127
- question="List all network connections on endpoint DESKTOP-ABC123",
97
+ question="List all network connections on endpoint123",
98
description="Display active and recent network connections from an endpoint",
99
category="network",
100
),
101
ExampleQuestion(
132
- question="What artifacts are available for Windows.System.Users?",
133
- description="Show available user account artifacts and information",
102
+ question="What artifacts are available for checking browser activity?",
103
+ description="Show available artifacts for browser activity analysis",
104
category="artifacts",
105
),
106
ExampleQuestion(
137
- question="Hunt for suspicious PowerShell executions across all endpoints",
138
- description="Search for potentially malicious PowerShell activity across the fleet",
139
- category="hunting",
140
- ),
141
- ExampleQuestion(
142
- question="Show me the registry keys modified in the last week on endpoint DESKTOP-ABC123",
143
- description="Track registry changes for security investigation",
144
- category="registry",
145
- ),
146
- ExampleQuestion(
147
- question="What scheduled tasks exist on endpoint DESKTOP-ABC123?",
107
+ question="What scheduled tasks exist on endpoint123?",
108
description="List all scheduled tasks for persistence analysis",
109
category="persistence",
110
),
@@ -199,8 +159,6 @@ class ExampleQuestionsService:
159
"Endpoint security scanning",
160
"Software inventory management",
161
"Network port analysis",
202
- "Vulnerability assessment",
203
- "Security event investigation",
162
],
163
),
164
MCPServerType.WAZUH_INDEXER: MCPServerInfo(
@@ -211,9 +169,7 @@ class ExampleQuestionsService:
169
"Log data search and analysis",
170
"Index management and statistics",
171
"Cluster health monitoring",
214
- "Document count and storage metrics",
215
- "Search performance analysis",
216
- "Data source analytics",
172
+ "Vulnerability assessment",
173
],
174
),
175
MCPServerType.VELOCIRAPTOR: MCPServerInfo(
@@ -223,10 +179,7 @@ class ExampleQuestionsService:
179
capabilities=[
180
"Live endpoint forensics",
181
"Artifact collection and analysis",
226
- "Threat hunting across endpoints",
182
"Process and network monitoring",
228
- "File system analysis",
229
- "Registry investigation",
183
"Persistence mechanism detection",
184
"Lateral movement hunting",
185
"Browser artifact collection",