Docusnap

Reads one information-security risk in full: current and target rating (likelihood, impact, score, level), lifecycle phase, treatment strategy and its justification, owner and organization when set, review dates and the number of linked threats, vulnerabilities and controls. Read-only. The linked records themselves are not part of the risk; use list_relations with the risk id to see them.

get_risk

Lists the comments on one record (an inventory object, a risk, a control, a CVE, a document, ...) in the order they were written. Read-only. Each comment carries its text, its author, its time and, for a reply, the id of the comment it answers.

list_comments

Lists the devices (hosts, servers, network and hardware devices) affected by one CVE. Read-only. Each entry carries the device id and name. Use the device id with get_inventory_object for its details.

list_affected_assets

Lists the records linked to one record, grouped by kind: for a risk its threats, vulnerabilities, controls and assets; for a control its risks, assessments and documents; for an inventory object the records it is linked to. Read-only. Each link carries the linked record's id, kind, name and the kind of link, so it can be read further with the matching get tool. Every group carries its count; a group lists at most 50 links, so narrow large groups (e.g. the CVEs of a server) with linked_type or use the matching search tool.

list_relations

Lists the inventory object types of the signed-in user's Docusnap365 environment: the standard types (e.g. Windows, Linux, switch, printer) and the types the organization defined itself. Read-only. Each result carries the type id, its technical name and its display label. Use the type id with describe_object_type to learn the type's fields, and with search_inventory to list the objects of that type. There are several hundred standard types: narrow the list with name_contains (the technical name, e.g. 'windows', 'server', 'printer') or label_contains (the display name in German or English, e.g. 'Zertifikat' or 'Certificate').

list_object_types

Searches the CVE findings (known software vulnerabilities from scans) of the signed-in user's Docusnap365 environment. Read-only. Use it to find critical CVEs, CVEs above a CVSS score, CVEs in a management status, or to look up a CVE number. Each result carries the CVE number, a short title, the CVSS score, the severity, the management status, the number of affected devices and whether a patch exists. Only CVEs that affect at least one device are returned. Use list_affected_assets to see the affected devices of one CVE. These are technical scan findings. Risk-management vulnerabilities (ISMS) are a different thing and are not returned here.

search_cves

Searches the IT asset management view of the inventory: lifecycle phase, owners, business criticality, end-of-life and warranty dates, validation state and data completeness per asset. Read-only. Use it to find assets approaching end of life, assets without complete ITAM data, or assets by lifecycle phase or criticality. Only object types that take part in IT asset management are included. The asset id is the inventory object id, usable with get_inventory_object.

search_itam_assets

Searches the compliance assessments (statement of applicability) of the activated frameworks, e.g. ISO 27001 Annex A. One result per assessable objective. Read-only. Framework names are stored in full, e.g. 'DIN EN ISO/IEC 27001:2024-01': filter with a distinctive part such as '27001' or 'C5'. For ISO 27001 Annex A only, add reference 'A.'. An objective whose applicability was not decided yet has applicability 'not_assessed'. Each result carries the objective reference and title, the framework, whether the objective applies (with the justification when it does not) and its implementation state. Results are in the order of the standard unless sort_by says otherwise.

search_assessments

Searches the security controls (measures) of the signed-in user's Docusnap365 environment. Read-only. Use it to list controls by implementation status or priority, or to find overdue controls. Each result carries status, priority, ISO 27002 theme, due date, due badge and the number of linked risks. A recurring control keeps the status 'implemented' between cycles; whether a cycle is overdue is shown by 'overdue' and the due date, not by the status. Use get_control for the full record of one control.

search_controls

Searches the cost sources (contracts and licence agreements) of IT asset management. Read-only. Each result carries the name, contract number, contract status, responsible user, number of cost positions, monthly costs, covered, still assignable and assigned quantity, and the contract period. The figures refer to the CURRENT month, which the answer names in 'period': state that period when reporting costs or assigned quantities.

search_cost_sources

Searches the documents (structured documents with chapters, approval workflow and versions, e.g. policies and IT concepts) of the signed-in user's Docusnap365 environment. Read-only. Each result carries the title, a human-readable id, the document type, the workflow status, whether the document is under formal document control, the next review date and the last change. Results are sorted by last change, newest first. File attachments are not documents in this sense and are not returned here.

search_documents

Searches the inventory objects (devices, systems, and records of types the organization defined itself) of the signed-in user's Docusnap365 environment. Read-only. Each result carries the object id, name, type label, status and last change. Questions about CPU, RAM, model, manufacturer or the number of installed software packages of devices need include_summary: these values are not fields of the object types. To get more, name the field keys of the object type in 'fields'; to narrow by them, add conditions in 'where'. Field keys differ per object type: get them from describe_object_type and give object_type_id, which 'where' requires. Requested values come under 'fields' by field key, the summary under 'summary'. With object_type_id, choice fields are returned and compared by value name, e.g. 'valid'. Use get_inventory_object for one object in full.

search_inventory

Searches the information-security risks (ISO 27001/27005) of the signed-in user's Docusnap365 environment. Read-only. Use it to list risks by level, lifecycle phase or treatment, to find risks that no control treats yet, or risks whose review is due. Each result carries the current risk level, the lifecycle phase, the treatment strategy, the owner when set, the next review date and the number of linked controls. Use get_risk for the full record of one risk. Results are sorted by risk score, highest first, unless sort_by says otherwise. Without filters the tool returns the highest-rated risks.

search_risks

Searches the hardware warranties of the signed-in user's Docusnap365 environment. Read-only. Use it to find warranties that expire soon or have expired. Each result carries the warranty name, the computed warranty state, the earliest coverage start, the latest coverage end and the hardware objects it covers. Results are sorted by coverage end, earliest first.

search_warranties

Changes the management of a CVE finding: its status, the justification, the responsible user and the remediation deadline. Only the fields given are changed. The status 'accepted' (risk accepted) and 'false_positive' require a reason. The technical CVE data (CVSS score, publication date) cannot be changed with this tool.

update_cve_status

Changes an existing inventory object: its name, organization, location and individual fields. Only what is given changes; every other value stays as it is. Field keys and allowed values come from describe_object_type; choice fields take the value name, and those marked writable: false cannot be set. Lists (installed software, network cards, ...) cannot be changed here. Objects found by a scan cannot be renamed, and a later scan may overwrite fields it collects.

update_inventory_object

Changes fields of an information-security risk. Only the fields given are changed; all other values stay as they are. Likelihood and impact can only be changed while the risk is in the lifecycle phase 'identified' or 'assessed'; in later phases the service refuses it. The lifecycle phase itself cannot be changed with this tool, and neither can the date of the last review. Changing the next review date reschedules the open review task of the risk; the answer lists such changes in taskEffects.

update_risk