Argus Annotation Filter Search Translator MCP Tools¶

This document describes the MCP tools available for Argus annotation filter search translation.

These tools help users:

General Notes¶

Use these tools when you want the LLM to turn your annotation-filter search intent into a valid search query.
Argus annotation filters define detection rules that identify relevant events from the real-time security event stream and can transform matching events.
Describe what you want to find in plain language, and the LLM can use the request fields in this document to build the search.
If sorting is involved, the LLM can look up the allowed sortBy values before building the query.
Returned allowed values are case-sensitive, so the LLM should keep them exactly as returned.
If you want actual search results after building the query, the LLM can then use the annotation filter search execution tool with the same search intent.

Purpose

Generate an Argus annotation filter search query from your search intent. The result is the generated annotation filter search JSON.

Arguments

High-level purpose: the full annotation filter search definition the LLM builds from your request.

Field	Description	Type	Default	Required
`filterID`	Match annotation filters by any of these filter IDs.	`array<number>`	None	No
`customer`	Match annotation filters belonging to any of the specified customers, using customer ID or short name.	`array<string>`	None	No
`includeAscendingCustomer`	When customer filtering is used, also include parent customers.	`boolean`	`false`	No
`includeDescendingCustomer`	When customer filtering is used, also include child customers.	`boolean`	`true`	No
`includeFilterFlag`	Annotation filter flags that must all be present. Allowed values: `enabled`, `controlled`.	`array<string>`	None	No
`excludeFilterFlag`	Annotation filter flags that must not be present. Exclusion still applies even if included flags match. Allowed values: `enabled`, `controlled`.	`array<string>`	None	No
`keywordFilter`	Keyword-based matching across annotation filter fields.	`object`	None	No
`timeFilter`	Time-based narrowing for annotation filter search.	`object`	None	No
`includeCode`	Whether statement and trigger code should be included in the result objects.	`boolean`	`false`	No
`page`	Pagination settings.	`object`	`{ "limit": 25, "offset": 0 }`	No
`sortBy`	Sort order list. Use list order as priority. Prefix with `-` for descending. When sorting is involved, the LLM can look up the allowed sort values behind the scenes.	`array<string>`	None	No

Field	Description	Type	Default	Required
`keywords`	Search terms to match.	`array<string>`	None	No
`keywordField`	Which annotation filter keyword fields to search. Allowed values: `id`, `name`, `description`, `label`, `preStatement1`, `preStatement2`, `statementCode`, `triggerCode`, `all`.	`array<string>`	`["all"]`	No
`keywordMatch`	How to evaluate multiple keywords. Allowed values: `any`, `all`. Required when keywords are present.	`string`	`all`	No

Field	Description	Type	Default	Required
`timeField`	Which annotation filter time field(s) the range applies to. Allowed values: `created`, `lastUpdated`.	`array<string>`	`["lastUpdated"]`	No
`startTime`	Start of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as `startOfDay - 1 day`.	`string`	None	No
`endTime`	End of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as `now`.	`string`	`now`	No
`timeMatchStrategy`	How to evaluate multiple `timeField` values. Allowed values: `any`, `all`. Mainly relevant when more than one time field is provided.	`string`	`any`	No

Field	Description	Type	Default	Required
`limit`	Maximum number of items per page. Accepted range: `1` to `100`.	`number`	`25`	No
`offset`	Number of items to skip before returning results. Must be `0` or greater.	`number`	`0`	No

Usage notes

Annotation filter search pagination supports 1 to 100 items per page. Values outside that range will fail.
For descending sorting, the LLM can use a - prefix such as -lastUpdated.
To search statement text, the LLM can use preStatement1, preStatement2, and statementCode.
Ask explicitly if you want annotation filter statement and trigger code included in search results, so the LLM can enable includeCode.

Purpose

Return the allowed sortBy values for Argus annotation filter search.

Arguments

This tool takes no arguments.

Current returned values

id, name, created, lastUpdated