Skip to content

Argus Analysis Filter Search Translator MCP Tools

This document describes the MCP tools available for Argus analysis filter search translation.

These tools help users:

  • build an Argus analysis filter search query payload
  • discover valid values for analysis filter sorting
  • validate search pagination and sort fields before retrieving results

General Notes

  • Use these tools when you want the LLM to turn your analysis-filter search intent into a valid search query.
  • Argus analysis filters define detection rules that identify relevant events from the real-time security event stream and can transform matching events.
  • Describe what you want to find in plain language, and the LLM can use the request fields in this document to build the search.
  • If sorting is involved, the LLM can look up the allowed sortBy values before building the query.
  • Returned allowed values are case-sensitive, so the LLM should keep them exactly as returned.
  • If you want actual search results after building the query, the LLM can then use the analysis filter search execution tool with the same search intent.

Tool: generateArgusAnalysisFilterSearchQuery

Purpose

Generate an Argus analysis filter search query from your search intent. The result is the generated analysis filter search JSON.

Arguments

Argument: request

High-level purpose: the full analysis filter search definition the LLM builds from your request.

  • Type: object
  • Required: Yes
  • Default: None

request fields

Field Description Type Default Required
filterID Match analysis filters by any of these filter IDs. array<number> None No
customer Match analysis filters belonging to any of the specified customers, using customer ID or short name. array<string> None No
includeAscendingCustomer When customer filtering is used, also include parent customers. boolean false No
includeDescendingCustomer When customer filtering is used, also include child customers. boolean true No
includeFilterFlag Analysis filter flags that must all be present. Allowed values: enabled, controlled, defaultAggregate, skipNewEvent. array<string> None No
excludeFilterFlag Analysis filter flags that must not be present. Exclusion still applies even if included flags match. Allowed values: enabled, controlled, defaultAggregate, skipNewEvent. array<string> None No
keywordFilter Keyword-based matching across analysis filter fields. object None No
timeFilter Time-based narrowing for analysis filter search. object None No
includeCode Whether statement and trigger code should be included in the result objects. boolean false No
page Pagination settings. object { "limit": 25, "offset": 0 } No
sortBy Sort order list. Use list order as priority. Prefix with - for descending. When sorting is involved, the LLM can look up the allowed sort values behind the scenes. array<string> None No

request.keywordFilter fields

Field Description Type Default Required
keywords Search terms to match. array<string> None No
keywordField Which analysis filter keyword fields to search. Allowed values: id, name, description, label, preStatement1, preStatement2, statementCode, triggerCode, all. array<string> ["all"] No
keywordMatch How to evaluate multiple keywords. Allowed values: any, all. Required when keywords are present. string all No

request.timeFilter fields

Field Description Type Default Required
timeField Which analysis filter time field(s) the range applies to. Allowed values: created, lastUpdated, all. array<string> ["lastUpdated"] No
startTime Start of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as startOfDay - 1 day. string None No
endTime End of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as now. string now No
timeMatchStrategy How to evaluate multiple timeField values. Allowed values: any, all. Mainly relevant when more than one time field is provided. string any No

request.page fields

Field Description Type Default Required
limit Maximum number of items per page. Accepted range: 1 to 100. number 25 No
offset Number of items to skip before returning results. Must be 0 or greater. number 0 No

Usage notes

  • Analysis filter search pagination supports 1 to 100 items per page. Values outside that range will fail.
  • For descending sorting, the LLM can use a - prefix such as -lastUpdated.
  • To search any statement text, the LLM can use preStatement1, preStatement2, and statementCode together.
  • Ask explicitly if you want analysis filter statement and trigger code included in search results, so the LLM can enable includeCode.

Tool: listArgusAnalysisFilterSearchSortBy

Purpose

Return the allowed sortBy values for Argus analysis filter search.

Arguments

This tool takes no arguments.

Current returned values

id, name, created, lastUpdated