Skip to main content
POST
Agent tool submit gamebook

Path Parameters

workspaceId
string<uuid>
required
source
enum<string>
required
Available options:
Sentinel,
DefenderXDR,
QRadar,
Splunk,
CrowdStrike,
SentinelOne
incidentId
string
required

Body

application/json

Request DTO for the agent's submit-gamebook tool. Allows the agent to queue one or more remediation gamebooks against an incident as it investigates.

incident_number

Sequential incident number from the source platform. Used in human-readable summaries and gamebook tracking.

incident_title
null | string

Human-readable incident title from the source platform. Used in summaries and audit logs.

trigger_type
enum<string>

How the agent run was triggered. OnQueue (background): subject to per-severity Gamebooks capability gating — submissions are rejected for severities where Gamebooks is not enabled. ManualInvestigateAndRespond (operator-requested): always allowed to submit gamebooks regardless of capability settings.

Available options:
OnQueue,
ManualInvestigateOnly,
ManualInvestigateAndRespond
playbooks
null | object[]

Ordered playbook actions to run as part of this gamebook. Each entry binds a playbook from the registered catalog to its target entity. Must contain at least one entry — empty arrays are rejected.

Response

OK

Standard v2 API response envelope for single-item responses.

data
object

Result of an agent submit-gamebook tool call. Designed for LLM consumption — the string AgentToolGamebookSubmissionResult.Summary field is a compact human-readable digest the agent can emit directly into chat or chain into follow-up reasoning.

meta
object