Add threat-report correlation

.env.example

@@ -14,6 +14,22 @@ CLUSTERS_JSON=[{"name":"primary","elasticsearchUrl":"https://your-cluster.es.clo
 # Alternative: load the same JSON from a file.
 # CLUSTERS_FILE=/absolute/path/to/clusters.json
 
+# --- Threat-report correlation ---------------------------------------------
+# Report corpus index pattern the correlation tools search. Defaults to
+# `ti-reports*`. Set TI_REPORTS_INDEX_PATTERN to point at a different corpus
+# (e.g. `.kibana-threat-reports*`).
+# TI_REPORTS_INDEX_PATTERN=ti-reports*
+#
+# Authoritative correlation is delegated to the `ti-correlation` Kibana Workflow.
+# Override the workflow id / run-record index if your deploy.sh uses non-defaults.
+# TI_CORRELATION_WORKFLOW_ID=ti-correlation
+# TI_CORRELATIONS_INDEX=ti-correlations
+#
+# Opt-in: when set, a completed correlation is also stamped into a self-contained
+# Cursor canvas (.canvas.tsx) in this dir. Unset → no-op (app behaves normally).
+# Point it at your Cursor project's canvases dir.
+# CORRELATION_CANVAS_DIR=/path/to/.cursor/projects/<project>/canvases
+
 # Telemetry endpoint override. Defaults to production (telemetry.elastic.co).
 # Set to `staging` to point at telemetry-staging.elastic.co — useful when
 # verifying dashboards or working on the MCP App's analytics locally.

.gitignore

@@ -4,6 +4,7 @@ dist/
 .mcp.json
 .vscode/mcp.json
 .env
+clusters.json
 .DS_Store
 *.code-workspace
 *.backup

manifest.json

@@ -57,7 +57,14 @@
     {
       "name": "generate-sample-data",
       "description": "Generate ECS-compliant security events for demos"
-    }
+    },
+    { "name": "correlate",               "description": "Correlate a case via the ti-correlation Kibana workflow (authoritative)" },
+    { "name": "get_correlation_run",      "description": "Poll a correlation run by id; return render-ready findings" },
+    { "name": "render_correlation",      "description": "Render the workflow's correlation deep-dive findings" },
+    { "name": "diamond_search",          "description": "Exploration aid: blind diamond-model corpus search" },
+    { "name": "get_report",              "description": "Exploration aid: fetch full threat report(s) by id" },
+    { "name": "diamond_search_analyst",  "description": "Exploration aid: scored diamond-model corpus search with triage view" },
+    { "name": "correlation_input_check", "description": "Exploration aid: per-vertex signal stoplight gate" }
   ],
   "tools_generated": true,
   "user_config": {