get_external_threat_feed

What get_external_threat_feed does on Fortimanager

AI agents call get_external_threat_feed to retrieve information from Fortimanager without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why get_external_threat_feed is rated Low

The tool retrieves information about an external threat feed configuration. The use of 'get' and 'details' clearly signals a read-only query operation. There is no modification, deletion, execution of commands, or financial impact. The blast radius of misuse is minimal—an attacker gains visibility into threat feed configurations but cannot alter security posture directly through this tool alone.

From the tool's definition Tool name 'get_external_threat_feed' and description 'Get details of a specific external threat feed' indicate a retrieval operation with no side effects.

The rule that runs get_external_threat_feed safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Fortimanager, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For get_external_threat_feed, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "get_external_threat_feed": {}
  }
}

Questions about get_external_threat_feed