Argus Event Search Translator MCP Tools

This document describes the MCP tools available for Argus event search translation.

These tools help users:

• build an Argus event search query payload

• discover valid values for event flags

• discover valid values for endpoint flags

• discover valid values for event sorting

General Notes

• Use this tool when you want the LLM to turn your event-search intent into a valid search query.

• Describe what you want to find in plain language, and the LLM can use the request fields in this document to build the search.

• If your request involves event flags, endpoint flags, or sorting, the LLM can look up the allowed values before building the query.

• This applies to includeEventFlag, excludeEventFlag, endpoint[].includeEndpointFlag, endpoint[].excludeEndpointFlag, and sortBy.

• The returned values are case-sensitive, so the LLM should keep them exactly as returned.

• If you want actual search results after building the query, the LLM can then use the event search execution tool with the same search intent.

Tool: generateArgusEventSearchQuery

Purpose

Generate an Argus event search query from your search intent. The result contains:

• searchCriteria: the generated event search JSON

• searchLink: a shareable Argus portal link for the same search

Arguments

Argument: request

High-level purpose: the full event search definition the LLM builds from your request.

• Type: object (ArgusEventSearchToolRequest)

• Required: Yes

• Default: None

Argument: includeProperties

High-level purpose: tells the LLM whether event properties should be included when it prepares the search and later fetches results.

• Type: boolean

• Required: Yes

• Default: false

request fields

Field	Description	Type	Default	Required
associateCaseID	Return events associated with any of these case IDs. 0 means events with no associated case.	array<number>	None	No
attack	Attack-related filter criteria. Each item is one criterion. By default criteria are OR-ed unless each item sets required: true.	array<object>	None	No
customer	Match events belonging to any of the specified customers, using customer ID or short name.	array<string>	None	No
domainName	Match events with any of the specified domain names.	array<string>	None	No
endpoint	Endpoint-related filter criteria for source or destination endpoints.	array<object>	None	No
severity	Match event severity values. Allowed values: low, medium, high, critical.	array<string>	None	No
eventIdentifier	Match specific event identifiers.	array<string>	None	No
type	Match event types. Allowed values: aggregated, raw.	array<string>	None	No
timeFilter	Time-based narrowing for the event search.	object	{ "timeField": ["created"], "startTime": "startOfDay", "endTime": "now", "timeMatchStrategy": "any" }	No
includeEventFlag	Event flags that must all be present on a matching event. When this filter is involved, the LLM can look up the allowed flag values behind the scenes.	array<string>	None	No
excludeEventFlag	Event flags that must not be present on a matching event. When this filter is involved, the LLM can look up the allowed flag values behind the scenes.	array<string>	None	No
property	Event property filter criteria.	array<object>	None	No
page	Pagination settings.	object	{ "limit": 25, "offset": 0 }	No
sortBy	Sort order list. Use list order as priority. Prefix with - for descending. When sorting is involved, the LLM can look up the allowed sort values behind the scenes.	array<string>	None	No

request.attack[] fields

Field	Description	Type	Default	Required
alarm	Match events triggered by any of these alarms, using alarm ID or short name.	array<string>	None	No
attackCategory	Match events triggered by any of these attack categories, using ID or short name.	array<string>	None	No
signature	Match events triggered by any of these information security signatures.	array<string>	None	No
exclude	Negate this criterion.	boolean	false	No
required	Whether this criterion must be combined with other criteria using AND instead of OR.	boolean	true	No

request.endpoint[] fields

Field	Description	Type	Default	Required
countryCode	Match endpoint country codes.	array<string>	None	No
endpointFieldStrategy	Which endpoint side to search. Allowed values: source, destination, all.	string	all	No
ip	Match endpoint IPs or CIDR networks. Supports IPv4, IPv6, and CIDR notation.	array<string>	None	No
minMaskBits	Minimum CIDR prefix length to match. Useful to exclude broad subnets.	number	None	No
port	Match endpoint ports.	array<number>	None	No
includeEndpointFlag	Endpoint flags that must all be present. When this filter is involved, the LLM can look up the allowed flag values behind the scenes.	array<string>	None	No
excludeEndpointFlag	Endpoint flags that must not be present. When this filter is involved, the LLM can look up the allowed flag values behind the scenes.	array<string>	None	No
exclude	Negate this criterion.	boolean	false	No
required	Whether this criterion must be combined with other criteria using AND instead of OR.	boolean	false	No

request.timeFilter fields

Field	Description	Type	Default	Required
timeField	Which event time field(s) the range applies to. Allowed values: created, lastUpdated, firstAssessment, enginePersisted, firstEvent, lastEvent, published, all.	array<string>	["created"]	No
startTime	Start of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as startOfDay - 1 day.	string	startOfDay	No
endTime	End of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as now.	string	now	No
timeMatchStrategy	How to evaluate multiple timeField values. Allowed values: any, all. Mainly relevant when more than one time field is provided.	string	any	No

request.property[] fields

Field	Description	Type	Default	Required
key	Property key to match.	string	None	Yes
value	Property values to match against the key.	array<string>	None	Yes
valueMatchStrategy	How to combine multiple values. Allowed values: any, all.	string	any	No
valueSearchStrategy	How to compare each value. Allowed values: tokenized, exact.	string	exact	No
exclude	Negate this criterion.	boolean	false	No
required	Whether this criterion must be combined with other criteria using AND instead of OR.	boolean	false	No

request.page fields

Field	Description	Type	Default	Required
limit	Maximum number of items per page. Accepted range: 1 to 100.	number	25	No
offset	Number of items to skip before returning results. Must be 0 or greater.	number	0	No

Usage notes

• If you want event properties included in the results, ask for that explicitly so the LLM can enable includeProperties.

• Event search pagination supports 1 to 100 items per page. Values outside that range will fail.

• For descending sorting, the LLM can use a - prefix such as -createdTimestamp.

• Event identifiers follow the format timestamp/customerID/eventID.

Tool: listArgusEventFlags

Purpose

Return the allowed event flag values for Argus event search.

Arguments

This tool takes no arguments.

Current returned values

established, blocked, partiallyBlocked, snapshot, finalized, falsePositive, notAThreat, tuningCandidate, notified, notifiedUnpublished, notifiedDeleted, followup, partiallyNotified, identifiedThreat, threatCandidate, acknowledged, partiallyAcknowledged, severityAdjusted, commented, filtered, checked, incompleteDetails, aggregatedBaseEvent, remoteStorage, hasDetails, hasPayload, hasPcap, associatedToCaseByFilter, severityIncreasedByFilter, severityReducedByFilter, createdByAnalysisFilter, extendEventTtl, initialTuning, postAnalysis, partialSslTerminated, sslTerminated, autoReport, missingTimestamp, clockOutOfSync, dropAnalysis, escalatedByReputation, hasSample, storeEvent, storeAggregated, handledByAnalyst, slaViolation, payloadTruncated, hasStringPayload, reassessed, eventFromOtEnvironment, eventFromRestrictedItEnvironment, failure

Tool: listArgusEndpointFlags

Purpose

Return the allowed endpoint flag values for endpoint filtering within Argus event search.

Arguments

This tool takes no arguments.

Current returned values

isCustomerNet, isPartialCustomerNet, customAggregation, isManagedBySoc

Tool: listArgusEventSearchSortBy

Purpose

Return the allowed sortBy values for Argus event search.

Arguments

This tool takes no arguments.

Current returned values

customerID, eventID, createdTimestamp, lastUpdatedTimestamp, firstEventTimestamp, lastEventTimestamp