Since the MCP server supports the powerful GraphQL Api for analytics and log correlation and investigation, it would be really helpful if the MCP server could also query currently configured rulesets and rules for the zones.
The investigation flow supported would then be :
- Fetch logs related to an investigation / incident (by IP, RayID etc)
- Understand what is happening
- Pinpoint which rule IDs performed actions (like blocking) on said set if requests in the logs
- Understand if this traffic should have been blocked but isn't
- Fetch the current active ruleset and understand if the rules are overly permissive or overly aggressive and suggest improvements