RAD Security

- Account inventory and cluster details
- Security findings analysis
- Runtime security and process behavior
- Network security monitoring
- Kubernetes object and misconfiguration policies
- CVE listing and vulnerability details

- list_containers: List containers secured by RAD Security with optional filtering by image name, image digest, namespace, cluster_id, or free text search
- get_container_details: Get detailed information about a container secured by RAD Security
- list_clusters: List Kubernetes clusters managed by RAD Security
- get_cluster_details: Get detailed information about a specific Kubernetes cluster managed by RAD Security
- who_shelled_into_pod: Get k8s audit logs with information about users who shelled into a pod
- list_images: List container images with optional filtering by page, page size, sort, and search query
- list_image_vulnerabilities: List vulnerabilities in a container image with optional filtering by severity
- get_top_vulnerable_images: Get the most vulnerable images from your account
- get_image_sbom: Get the SBOM of a container image
- ignore_cve: Ignore a CVE for this account so it no longer appears in vulnerability reporting. Use for confirmed false positives, accepted risks, or won't-fix decisions. Do NOT use for remediated CVEs — those drop off automatically on the next scan.
- unignore_cve: Remove an account-wide CVE disposition, restoring the CVE to vulnerability reporting.
- list_cve_dispositions: List active CVE dispositions (ignored / false positive) for this account, with reason and author.
- get_k8s_resource_details: Get the latest manifest of a Kubernetes resource
- list_k8s_resources: List Kubernetes resources with optional filtering by namespace, resource types, and cluster
- get_containers_process_trees: Get process trees for multiple containers
- get_containers_baselines: Get runtime baselines for multiple containers
- get_container_llm_analysis: Get LLM analysis of a container's process tree
- list_security_findings: List security findings with optional filtering by types, severities, sources, and status
- update_security_finding_status: Update the status of a security finding
- mark_inbox_item_as_false_positive: Mark an inbox item as a false positive with a reason
- list_inbox_items: List inbox items with optional filtering by any field. Multiple filters can be combined eg. 'search:cve-2024-12345 and severity:high'
- get_inbox_item_details: Get detailed information about a specific inbox item
- list_workflows: List all workflows
- get_workflow: Get detailed information about a specific workflow by ID. It contains the workflow definition, default arguments, and schema how to run the workflow
- list_workflow_runs: List workflow runs with optional filtering by workflow ID
- get_workflow_run: Get detailed information about a specific workflow run
- run_workflow: Run a workflow with optional argument overrides
- list_workflow_schedules: List workflow schedules with optional filtering by workflow ID
- create_custom_workflow: Create a new automation (a Windmill workflow) from a YAML definition. Pass the YAML document itself as a string, not a file path. It is validated server-side before deployment; on failure nothing is deployed and the errors are returned. Returns the new automation WITHOUT echoing the definition back — use id from the result when referring to it, and get_workflow if you need to read the definition.
- update_custom_workflow: Update an existing automation with new YAML. Only automations created via create_custom_workflow can be updated. Returns the updated automation without echoing the definition back.
- add_workflow_schedule: Add a cron-based schedule to an automation so it runs automatically at the specified times.
- search_knowledge_base: Search your organization's knowledge base to find relevant uploaded documents, procedures, reports, and other content using natural language queries
- list_knowledge_base_collections: List all collections in your organization's knowledge base. Collections are used to organize and categorize documents
- list_knowledge_base_documents: List documents in your organization's knowledge base with optional filtering by collections, file type, or status
- query_knowledge_base_document: Query a CSV document from the knowledge base using natural language. IMPORTANT: This tool ONLY works with CSV documents. Use list_knowledge_base_documents with filters='file_type:csv' to find CSV document IDs (search_knowledge_base results also contain document IDs). Results are returned as a markdown table
- get_knowledge_base_document_content: Get the FULL text content of a knowledge base document (extracted text for PDF/DOCX, the raw file for markdown/plaintext/CSV). Use this to read or analyze a whole document rather than the excerpts search_knowledge_base returns. Find document IDs via list_knowledge_base_documents or search_knowledge_base results
- get_knowledge_base_document_download_url: Get a time-limited download URL for the ORIGINAL document file (any format, including PDF/DOCX binaries). Use when you need the original file itself — e.g. to fetch it into a sandbox for structural parsing (tables, layout), or when get_knowledge_base_document_content reports no text available. For reading text, prefer get_knowledge_base_document_content
- radql_list_data_types: List all available RadQL data types (discovery). ALWAYS call this FIRST before using other RadQL tools to discover what data is available to query. Returns data types like 'containers', 'kubernetes_resources', 'inbox_items', 'cloud_resources', 'cloud_benchmarks', 'cloud_benchmark_summaries', etc. with descriptions.
- radql_get_type_metadata: Get schema/metadata for a specific RadQL data type. Shows available fields, data types, which fields can be filtered/searched, and provides query examples. Call this AFTER radql_list_data_types to understand how to query a specific data type.
- radql_list_filter_values: List possible values for a filter field (e.g., namespace list, cluster list, severity values). Useful for building dynamic filters when you need to know available enum-like values. Call this when constructing filters that need specific values.
- radql_query: Execute RadQL queries for security investigations. Supports: list (filter/search), get_by_id (single item), stats (aggregations).

WORKFLOW: radql_list_data_types -> radql_get_type_metadata -> radql_query

COMMON FIELDS BY DATA TYPE:
containers: name, image_name, image_repo, owner_kind, cluster_id, created_at
Example: image_name:nginx AND owner_kind:Pod

finding_groups: type, source_kind, source_name, rule_title, severity, event_timestamp
Types: k8s_misconfiguration, k8s_audit_logs_anomaly
Example: type:k8s_misconfiguration AND severity:critical

inbox_items: severity (High|Medium|Low), type, title, archived, false_positive, created_at
Example: severity:High AND archived:false

kubernetes_resources: kind, name, namespace, cluster_id, owner_kind, created_at
Example: kind:Deployment AND namespace:production

CLOUD RESOURCES & COMPLIANCE (use these RadQL data types instead of dedicated cloud tools):
cloud_resources: cloud_provider, cloud_account_id, resource_type, resource_name, resource_id, resource_json, last_seen_at
Example: cloud_provider:aws AND resource_type:aws_iam_policy

cloud_benchmark_summaries: cloud_provider, cloud_account_id, benchmark_id, title, description, fail_count, pass_count, total_count, last_seen_at
Example: cloud_provider:aws AND fail_count>0

cloud_benchmarks: cloud_provider, cloud_account_id, benchmark_id, control_id, control_title, severity, status, reason, resource_id, last_seen_at
Example: status:fail AND benchmark_id:cis

CRITICAL QUOTING RULES:
MUST quote when value contains:
- Dates/timestamps: created_at>"2024-01-01" (NOT created_at>2024-01-01)
- Hyphens: cluster_id:"abc-123-def", name:"kube-system"
- UUIDs: id:"550e8400-e29b-41d4-a716-446655440000"
- Spaces: title:"my alert"
- Special chars: :, =, <, >, !, (, )
- Wildcards with hyphens: name:"kube-"

OK to leave unquoted:
- Simple strings: status:active, kind:Pod
- Numbers: count:123
- Booleans: archived:true
- Simple wildcards: name:nginx

For complete schema: call radql_get_type_metadata with target data_type
- radql_query_builder: Helper tool to build RadQL queries programmatically from structured conditions. Useful when you need to construct complex filter or stats queries from structured inputs.
- radql_batch_query: Execute multiple RadQL queries in parallel for efficiency. Useful for fetching related data from different data types simultaneously (e.g., container details + vulnerabilities + network connections).
- list_widget_templates: List widget templates with optional filtering by visualization type and category
- get_widget_template: Get detailed information about a specific widget template
- list_dashboard_templates: List dashboard templates with optional filtering by category
- get_dashboard_template: Get detailed information about a specific dashboard template
- list_dashboards: List dashboards for the account
- get_dashboard: Get detailed information about a specific dashboard
- create_dashboard: Create a dashboard for the account. Build rows from the widget templates (list_widget_templates / get_widget_template) so the visualization and query shapes are valid.
- update_dashboard: Update an existing dashboard. Omitted fields are left unchanged, so a small edit (a title, one row) does not require resending the whole dashboard.
- list_external_integrations: List external integrations configured for the tenant (e.g., Slack, AWS CloudTrail, Okta). Returns integration details including capabilities, configuration, mcp support and sync status.