@SoarTool 어노테이션

@SoarTool(
    name = "lookup_user_activity",
    description = "Retrieves recent activity logs for a specific user",
    approval = ApprovalRequirement.NONE,
    maxExecutionsPerHour = 500,
    timeoutMs = 10000
)
public List<ActivityLog> lookupUserActivity(String userId, int hours) {
    return activityLogRepository.findRecentByUserId(userId, hours);
}

@SoarTool(
    name = "block_ip_address",
    description = "Blocks an IP address at the firewall level",
    approval = ApprovalRequirement.REQUIRED,
    requiredPermissions = {"SOAR_BLOCK_IP"},
    allowedEnvironments = {"staging", "prod"},
    maxExecutionsPerHour = 50,
    retryable = false,
    timeoutMs = 60000
)
public BlockResult blockIpAddress(String ipAddress, String reason, int durationHours) {
    return firewallService.blockIp(ipAddress, reason, Duration.ofHours(durationHours));
}

@SoarTool(
    name = "isolate_host",
    description = "Isolates a compromised host from the network",
    approval = ApprovalRequirement.MULTI_APPROVAL,
    requiredPermissions = {"SOAR_ISOLATE_HOST", "INFRA_ADMIN"},
    allowedEnvironments = {"prod"},
    maxExecutionsPerHour = 10,
    retryable = false,
    auditRequired = true,
    timeoutMs = 120000
)
public IsolationResult isolateHost(String hostname, String incidentId) {
    return networkService.isolateHost(hostname, incidentId);
}

// Class-level annotation applies defaults to all methods in the class
@SoarTool(
    approval = ApprovalRequirement.NOTIFICATION,
    requiredPermissions = {"SOAR_NOTIFICATION"},
    maxExecutionsPerHour = 200
)
@Component
public class NotificationTools {

    @SoarTool(
        name = "send_slack_alert",
        description = "Sends a security alert to the designated Slack channel"
    )
    public void sendSlackAlert(String channel, String message, String severity) {
        slackService.sendMessage(channel, formatAlert(message, severity));
    }

    @SoarTool(
        name = "send_email_alert",
        description = "Sends a security alert email to the incident response team"
    )
    public void sendEmailAlert(String subject, String body, List<String> recipients) {
        emailService.send(recipients, subject, body);
    }
}