Use the Cortex MCP server

Investigate Cortex data with built-in MCP tools.

The Cortex MCP server provides built-in tools to manage cases and issues and conduct investigations.

Built-in tools

Built-in tools include, but are not limited to:

• get_assets retrieves all assets or a filtered subset.
• get_assets_by_id retrieves details for one asset.
• get_cases retrieves cases by criteria such as domain, status, or severity.
• get_issues retrieves issues by criteria such as domain, severity, or detection method.
• get_assessment_profile_results retrieves compliance-assessment results.
• get_filtered_endpoints retrieves endpoints using agent status and other filters.

When you run the update command in the Cortex MCP server, new or updated tools provided by Cortex are automatically downloaded.

You also have the flexibility to create and customize your own tools to fit specific use cases and workflows. For more information, see Create custom Cortex MCP server tools.

Note

The built-in tools retrieve information, but do not write to the tenant. You can create your own tools that include write actions. The examples below include both.

Use case examples

• Show the ten most critical cases. Create a graph for management.
• Give details for case ID 12345. Create a visual timeline.
• Isolate endpoint WIN-123 because it may be compromised.
• Retrieve full details for endpoint XXXX.
• Add a note to case 12345: “Escalated to Tier 2 for further investigation.”