{"server":"correlate","transport":"jsonrpc-http","tools":[{"name":"correlate_events","description":"Correlate raw SIEM events into typed relationships, activity chains and a receipt.","inputSchema":{"type":"object","required":["events"],"properties":{"events":{"type":"array","items":{"type":"object"}},"internalNetworks":{"type":"array","items":{"type":"string"}}}}},{"name":"normalize_events","description":"Normalize raw SIEM events into canonical observations without correlating.","inputSchema":{"type":"object","required":["events"],"properties":{"events":{"type":"array","items":{"type":"object"}}}}},{"name":"explain","description":"Explain a relationship or chain from a set of events with full provenance.","inputSchema":{"type":"object","required":["events"],"properties":{"events":{"type":"array","items":{"type":"object"}},"relationshipId":{"type":"string"},"chainId":{"type":"string"}}}},{"name":"list_rules","description":"List the correlation rule catalog.","inputSchema":{"type":"object","properties":{}}},{"name":"run_demo","description":"Correlate the bundled reference incident.","inputSchema":{"type":"object","properties":{}}}]}