From 5be68d2fc82443332dbbe037aaee2d1a096bc803 Mon Sep 17 00:00:00 2001 From: "Elwood (Dan's DA)" Date: Thu, 13 Aug 2026 09:25:00 -0400 Subject: [PATCH] fix(secops): include entity values in related entities formatter The lookup_entity formatter was only displaying the entity type for related entities, omitting the actual entity values (IPs, domains, hashes, etc.). This fix adds the entity value to the output alongside the type, providing complete information about related entities in the summary. Changes: - Initialize entity_value default to 'Unknown' - Extract entity.value attribute if available - Update output format to include both value and type --- server/secops/secops_mcp/tools/entity_lookup.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/server/secops/secops_mcp/tools/entity_lookup.py b/server/secops/secops_mcp/tools/entity_lookup.py index b8238db4..fe1a8e43 100644 --- a/server/secops/secops_mcp/tools/entity_lookup.py +++ b/server/secops/secops_mcp/tools/entity_lookup.py @@ -138,10 +138,13 @@ async def lookup_entity( result += f'Related Entities ({len(related_entities)}):\n' for i, entity in enumerate(related_entities[:5], 1): # Limit to 5 related entities entity_type = 'Unknown' + entity_value = 'Unknown' if hasattr(entity, 'metadata') and hasattr(entity.metadata, 'entity_type'): entity_type = entity.metadata.entity_type + if hasattr(entity, 'value'): + entity_value = entity.value - result += f'{i}. Type: {entity_type}\n' + result += f'{i}. Value: {entity_value}, Type: {entity_type}\n' if len(related_entities) > 5: result += f'... and {len(related_entities) - 5} more related entities\n'