Tool Configuration

Overview

IncidentFox provides 50+ built-in tools across multiple categories. Each tool can be:

Enabled/disabled per team
Configured with credentials and settings
Customized with team-specific defaults

Tool Categories

Category	Tools	Description
Kubernetes	9	Pod logs, deployments, events, resource usage
AWS	8	EC2, Lambda, RDS, ECS, CloudWatch
Anomaly Detection	8	Prophet forecasting, Z-score, correlation
Grafana	6	Dashboards, Prometheus queries, alerts
Datadog	3	Metrics, logs, APM
New Relic	2	NRQL queries, APM summary
Coralogix	4	Log search, alerts, metrics
Snowflake	3	SQL queries, data enrichment
GitHub	16	Code search, PRs, issues, workflows
Git	12	Status, diff, log, blame
Docker	15	Build, run, logs, exec
Elasticsearch	3	Log search, aggregations
Slack	5	Messages, channels, threads

Configuration Structure

Tools are configured under the tools key:

{
  "tools": {
    "kubernetes": {
      "enabled": true,
      "default_namespace": "production",
      "kubeconfig_path": "/path/to/kubeconfig"
    },
    "coralogix": {
      "enabled": true,
      "api_key": "vault://secrets/coralogix-api-key",
      "domain": "coralogix.com"
    },
    "snowflake": {
      "enabled": true,
      "account": "acme.us-west-2",
      "warehouse": "COMPUTE_WH",
      "credentials": "vault://secrets/snowflake"
    }
  }
}

Common Configuration Options

All Tools

Option	Type	Description
`enabled`	boolean	Enable/disable the tool
`timeout`	integer	Max execution time in seconds

Credentials

Always use vault references for secrets:

{
  "api_key": "vault://path/to/secret",
  "password": "vault://path/to/password"
}

Never store credentials in plain text. Always use vault references.

Tool-Specific Configuration

Kubernetes

{
  "tools": {
    "kubernetes": {
      "enabled": true,
      "kubeconfig_path": "~/.kube/config",
      "default_namespace": "production",
      "default_context": "prod-cluster",
      "timeout": 30
    }
  }
}

Option	Default	Description
`kubeconfig_path`	`~/.kube/config`	Path to kubeconfig file
`default_namespace`	`default`	Default namespace for queries
`default_context`	Current context	K8s context to use
`timeout`	30	Command timeout in seconds

AWS

{
  "tools": {
    "aws": {
      "enabled": true,
      "region": "us-west-2",
      "profile": "production",
      "assume_role": "arn:aws:iam::123456789:role/incidentfox"
    }
  }
}

Option	Default	Description
`region`	From env	AWS region
`profile`	`default`	AWS profile name
`assume_role`	None	IAM role ARN to assume

Coralogix

{
  "tools": {
    "coralogix": {
      "enabled": true,
      "api_key": "vault://secrets/coralogix-api-key",
      "domain": "coralogix.com",
      "default_application": "production",
      "default_subsystem": "backend"
    }
  }
}

Option	Required	Description
`api_key`	Yes	Coralogix API key
`domain`	Yes	Coralogix domain (e.g., `coralogix.com`, `eu2.coralogix.com`)
`default_application`	No	Default application filter
`default_subsystem`	No	Default subsystem filter

Snowflake

{
  "tools": {
    "snowflake": {
      "enabled": true,
      "account": "acme.us-west-2",
      "username": "vault://secrets/snowflake-user",
      "password": "vault://secrets/snowflake-pass",
      "warehouse": "COMPUTE_WH",
      "database": "ANALYTICS",
      "schema": "PUBLIC",
      "role": "ANALYST"
    }
  }
}

Option	Required	Description
`account`	Yes	Snowflake account identifier
`username`	Yes	Username for authentication
`password`	Yes	Password (use vault reference)
`warehouse`	Yes	Default warehouse
`database`	No	Default database
`schema`	No	Default schema
`role`	No	Snowflake role to use

Datadog

{
  "tools": {
    "datadog": {
      "enabled": true,
      "api_key": "vault://secrets/datadog-api-key",
      "app_key": "vault://secrets/datadog-app-key",
      "site": "datadoghq.com"
    }
  }
}

Option	Required	Description
`api_key`	Yes	Datadog API key
`app_key`	Yes	Datadog Application key
`site`	No	Datadog site (default: `datadoghq.com`)

Grafana

{
  "tools": {
    "grafana": {
      "enabled": true,
      "url": "https://grafana.company.com",
      "api_key": "vault://secrets/grafana-api-key",
      "default_datasource": "Prometheus"
    }
  }
}

Option	Required	Description
`url`	Yes	Grafana instance URL
`api_key`	Yes	Grafana API key
`default_datasource`	No	Default data source name

GitHub

{
  "tools": {
    "github": {
      "enabled": true,
      "token": "vault://secrets/github-token",
      "default_org": "acme-corp",
      "default_repo": "main-app"
    }
  }
}

Option	Required	Description
`token`	Yes	GitHub Personal Access Token
`default_org`	No	Default organization
`default_repo`	No	Default repository

Disabling Dangerous Tools

For security, you may want to disable certain tools:

{
  "agents": {
    "investigation_agent": {
      "disable_default_tools": [
        "shell",
        "docker_exec",
        "db_write",
        "remediation_actions"
      ]
    }
  }
}

Consider which tools are appropriate for each environment. Production may need stricter controls than staging.

Tool Loading Priority

When an agent needs a tool, the system checks:

Is the integration installed? (package availability)
Are credentials configured? (tool config + vault)
Is it enabled for this team? (team config)
Is it allowed for this agent? (agent config)

All conditions must be met for the tool to be available.

Monitoring Tool Usage

View tool usage metrics in the Web UI under Team Console > Agent Runs. Each investigation shows:

Which tools were invoked
Execution time per tool
Success/failure status
Tool output (redacted as needed)

Next Steps

Data Sources

Detailed setup for each data source

Custom MCP Tools

Add custom tools via MCP

Getting Started

Core Concepts

Configuration

Integrations

Data Sources

Tools Catalog

Overview

Tool Categories

Configuration Structure

Common Configuration Options

All Tools

Credentials

Tool-Specific Configuration

Kubernetes

AWS

Coralogix

Snowflake

Datadog

Grafana

GitHub

Disabling Dangerous Tools

Tool Loading Priority

Monitoring Tool Usage

Next Steps

Data Sources

Custom MCP Tools

​Overview

​Tool Categories

​Configuration Structure

​Common Configuration Options

​All Tools

​Credentials

​Tool-Specific Configuration

​Kubernetes

​AWS

​Coralogix

​Snowflake

​Datadog

​Grafana

​GitHub

​Disabling Dangerous Tools

​Tool Loading Priority

​Monitoring Tool Usage

​Next Steps

Data Sources

Custom MCP Tools

Overview

Tool Categories

Configuration Structure

Common Configuration Options

All Tools

Credentials

Tool-Specific Configuration

Kubernetes

AWS

Coralogix

Snowflake

Datadog

Grafana

GitHub

Disabling Dangerous Tools

Tool Loading Priority

Monitoring Tool Usage

Next Steps