incidentoracle

Tools

Token cost is the o200k count of the tools list JSON, including schemas, before any tool is called.

• log_incident

  Log a new ICT-related incident. First step in the DORA incident management process (Art. 17).

• classify_incident

  Classify an incident against the 6 DORA criteria (RTS 2024/1772). Determines if MAJOR (triggers 4h/72h/1m reporting) or NON-MAJOR.

• major_incident_check

  Quick check: would these criteria values classify as a MAJOR incident? No incident record needed — use for pre-assessment.

• initial_notification

  Generate the 4h initial notification for a MAJOR incident (ITS 2025/302 Annex I). Must be submitted within 4h of classification, max 24h after detection.

• intermediate_report

  Generate the 72h intermediate report for a MAJOR incident (ITS 2025/302). Must include action plan if incident is not yet resolved.

• final_report

  Generate the 1-month final report with root cause analysis and lessons learned.

• deadline_tracker

  Track all active MAJOR incident reporting deadlines. Shows overdue and upcoming.

• reclassify

  Reclassify an incident (MAJOR to NON-MAJOR or vice versa). Competent authority must be notified of reclassification.

• incident_stats

  Dashboard: total/open/major incidents, overdue deadlines, by severity/status.

• cyber_threat_notify

  Voluntary notification of a significant cyber threat (Art. 19(2)). Uses ITS 2025/302 Annex III template.

• incident_log

  Full incident register with filters (status, classification, severity, search).

• health_check

  Server status.