Argus Analysis Filter Search Translator MCP Tools

This document describes the MCP tools available for Argus analysis filter search translation.

These tools help users:

• build an Argus analysis filter search query payload

• discover valid values for analysis filter sorting

• validate search pagination and sort fields before retrieving results

General Notes

• Use these tools when you want the LLM to turn your analysis-filter search intent into a valid search query.

• Argus analysis filters define detection rules that identify relevant events from the real-time security event stream and can transform matching events.

• Describe what you want to find in plain language, and the LLM can use the request fields in this document to build the search.

• If sorting is involved, the LLM can look up the allowed sortBy values before building the query.

• Returned allowed values are case-sensitive, so the LLM should keep them exactly as returned.

• If you want actual search results after building the query, the LLM can then use the analysis filter search execution tool with the same search intent.

Tool: generateArgusAnalysisFilterSearchQuery

Purpose

Generate an Argus analysis filter search query from your search intent. The result is the generated analysis filter search JSON.

Arguments

Argument: request

High-level purpose: the full analysis filter search definition the LLM builds from your request.

• Type: object

• Required: Yes

• Default: None

request fields

Field	Description	Type	Default	Required
filterID	Match analysis filters by any of these filter IDs.	array<number>	None	No
customer	Match analysis filters belonging to any of the specified customers, using customer ID or short name.	array<string>	None	No
includeAscendingCustomer	When customer filtering is used, also include parent customers.	boolean	false	No
includeDescendingCustomer	When customer filtering is used, also include child customers.	boolean	true	No
includeFilterFlag	Analysis filter flags that must all be present. Allowed values: enabled, controlled, defaultAggregate, skipNewEvent.	array<string>	None	No
excludeFilterFlag	Analysis filter flags that must not be present. Exclusion still applies even if included flags match. Allowed values: enabled, controlled, defaultAggregate, skipNewEvent.	array<string>	None	No
keywordFilter	Keyword-based matching across analysis filter fields.	object	None	No
timeFilter	Time-based narrowing for analysis filter search.	object	None	No
includeCode	Whether statement and trigger code should be included in the result objects.	boolean	false	No
page	Pagination settings.	object	{ "limit": 25, "offset": 0 }	No
sortBy	Sort order list. Use list order as priority. Prefix with - for descending. When sorting is involved, the LLM can look up the allowed sort values behind the scenes.	array<string>	None	No

request.keywordFilter fields

Field	Description	Type	Default	Required
keywords	Search terms to match.	array<string>	None	No
keywordField	Which analysis filter keyword fields to search. Allowed values: id, name, description, label, preStatement1, preStatement2, statementCode, triggerCode, all.	array<string>	["all"]	No
keywordMatch	How to evaluate multiple keywords. Allowed values: any, all. Required when keywords are present.	string	all	No

request.timeFilter fields

Field	Description	Type	Default	Required
timeField	Which analysis filter time field(s) the range applies to. Allowed values: created, lastUpdated, all.	array<string>	["lastUpdated"]	No
startTime	Start of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as startOfDay - 1 day.	string	None	No
endTime	End of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as now.	string	now	No
timeMatchStrategy	How to evaluate multiple timeField values. Allowed values: any, all. Mainly relevant when more than one time field is provided.	string	any	No

request.page fields

Field	Description	Type	Default	Required
limit	Maximum number of items per page. Accepted range: 1 to 100.	number	25	No
offset	Number of items to skip before returning results. Must be 0 or greater.	number	0	No

Usage notes

• Analysis filter search pagination supports 1 to 100 items per page. Values outside that range will fail.

• For descending sorting, the LLM can use a - prefix such as -lastUpdated.

• To search any statement text, the LLM can use preStatement1, preStatement2, and statementCode together.

• Ask explicitly if you want analysis filter statement and trigger code included in search results, so the LLM can enable includeCode.

Tool: listArgusAnalysisFilterSearchSortBy

Purpose

Return the allowed sortBy values for Argus analysis filter search.

Arguments

This tool takes no arguments.

Current returned values

id, name, created, lastUpdated