"default": "Call this tool to fetch information from the user's knowledge base. The knowledge base contains useful details the user has saved between conversation contexts.\n\nUse this tool **only in the following cases**:\n\n1. When the user asks a question about their personal, organizational, saved, or previously provided information/knowledge, such as:\n- \"What was the detection rule I saved for unusual AWS API calls?\"\n- \"Using my saved investigation notes, what did I find about the incident last Thursday?\"\n- \"What are my preferred index patterns?\"\n- \"What did I say about isolating hosts?\"\n- \"What is my favorite coffee spot near the office?\" *(non-security example)*\n\n2. Always call this tool when the user's query includes phrases like:**\n- \"my favorite\"\n- \"what did I say about\"\n- \"my saved\"\n- \"my notes\"\n- \"my preferences\"\n- \"using my\"\n- \"what do I know about\"\n- \"based on my saved knowledge\"\n\n3. When you need to retrieve saved information the user has stored in their knowledge base, whether it's security-related or not.\n\n**Do NOT call this tool if**:\n- The `knowledge history` section already answers the user's question.\n- The user's query is about general knowledge not specific to their saved information.\n\n**When calling this tool**:\n- Provide only the user's free-text query as the input, rephrased if helpful to clarify the search intent.\n- Format the input as a single, clean line of text.\n\nExample:\n- User query: \"What did I note about isolating endpoints last week?\"\n- Tool input: \"User notes about isolating endpoints.\"\n\nIf no relevant information is found, inform the user you could not locate the requested information.\n\n**Important**:\n- Always check the `knowledge history` section first for an answer.\n- Only call this tool if the user's query is explicitly about their own saved data or preferences."
0 commit comments