Argus Metric REST MCP Tools

These tools let the LLM retrieve live Argus metric aggregation results from the Argus metrics API.

They currently support ProcessingEventsPerFilter metrics, which describe event filter processing activity across Argus detection pipelines.

General Notes

• Use these tools when you want the LLM to calculate live metric aggregations from Argus APIs.

• The LLM should first use the Metric Search Translator MCP tools to shape and validate the aggregation request.

• ProcessingEventsPerFilter metrics cover annotation filters, analysis filters, and match filters.

• At least one statistics.values item is required for a meaningful aggregation.

• Metric aggregation responses are source-of-truth results. The LLM should explain returned metric values only, without inventing missing buckets, customers, timestamps, units, or key translations.

Tool: executeProcessingEventsPerFilterMetricAggregation

Purpose

Execute an aggregation for ProcessingEventsPerFilter metric records. The result contains aggregated metric values for the selected filters, groupings, and time buckets.

Arguments

Field	Description	Type	Default	Required
request	ProcessingEventsPerFilter metric aggregation definition prepared and validated from the user’s request.	object	None	Yes

request Fields

Field	Description	Type	Default	Required
filter	Filters that select which metric records are included before aggregation.	object	Empty filter with default time range	No
statistics	Aggregation configuration for selected metric values, grouping, and time bucketing. Must include at least one values item.	object	Empty statistics request	Yes
translateKey	Whether descriptor key values should be translated for display where translation is available.	boolean	true	No

request.filter Fields

Field	Description	Type	Default	Required
customer	Include metric records for any of the specified customers, using customer ID or short name.	array<string>	None	No
timeFilter	Time range based on when metric records were submitted to the central Argus metric service.	object	{ "startTime": "startOfDay", "endTime": "now" }	No
keyFilter	Filters for ProcessingEventsPerFilter descriptor keys, such as filter ID, filter type, host, component instance, or pipeline stage.	object	None	No

request.filter.timeFilter Fields

Field	Description	Type	Default	Required
startTime	Start of the metric submission time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as startOfDay - 1 day.	string	startOfDay	No
endTime	End of the metric submission time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as now.	string	now	No

request.filter.keyFilter Fields

Field	Description	Type	Default	Required
filterID	Include metrics for any of the specified event filter IDs.	array<number>	None	No
filterType	Include metrics for selected event filter types. Allowed values: AnnotationFilter, AnalysisFilter, MatchFilter.	array<string>	None	No
componentHost	Include metrics from any of the specified detection pipeline host names.	array<string>	None	No
componentInstanceID	Include metrics from any of the specified detection pipeline component instance IDs.	array<number>	None	No
stage	Include metrics from any of the specified detection pipeline stages.	array<string>	None	No

request.statistics Fields

Field	Description	Type	Default	Required
timeBucket	Time bucketing configuration based on metric submission time. Use this for requests such as per hour, per day, or one bucket for the whole range.	object	{ "resolution": 0, "resolutionUnit": "hours" }	No
groupBy	Descriptor keys used to group the aggregation result. List order controls the grouping hierarchy.	array<object>	Empty list	No
includeOthersForGroupBy	Whether data excluded by group-by limits should be collected into an Others bucket. Applies only when groupBy is used.	boolean	true	No
values	Metric values to aggregate. At least one item is required.	array<object>	Empty list	Yes

request.statistics.timeBucket Fields

Field	Description	Type	Default	Required
resolution	Bucket size as a number using resolutionUnit. Use 0 to aggregate the full requested time range into one bucket. Values above 10000 are capped at 10000.	number	0	No
resolutionUnit	Unit for resolution. Allowed values: milliseconds, seconds, minutes, hours, days.	string	hours	No

request.statistics.groupBy[] Fields

Field	Description	Type	Default	Required
key	Descriptor key used to group the aggregation result. Allowed values: customer, filterID, filterType, componentHost, componentInstanceID, stage.	string	None	Yes
limit	Maximum number of top buckets returned for this group-by key. Accepted range: 1 to 10000; values above 10000 are capped at 10000.	number	10	No

request.statistics.values[] Fields

Field	Description	Type	Default	Required
name	Metric value to aggregate. Allowed values: matchTimeMS, triggerCount, triggerTimeMS.	string	None	Yes
aggregationFunction	Aggregation function to apply. Allowed values: sum, avg, min, max, wavg, sumOfSquares.	string	sum	No
weightByValue	Metric value to use as the weight when aggregationFunction is wavg. Allowed values: matchTimeMS, triggerCount, triggerTimeMS.	string	None	Required for wavg

Metric Values

Value	Meaning
matchTimeMS	Time spent in milliseconds by filter logic while filtering events from the realtime stream.
triggerCount	Number of events matched by the filter.
triggerTimeMS	Time spent in milliseconds by trigger logic on events matched by the filter.

Response Notes

The response contains aggregated metric records.

Each item in data is one aggregate result, optionally grouped by customer, descriptor keys, and time bucket.

Important response fields:

• customer: customer associated with the aggregate, if present.

• keys: grouping key values for the aggregate. Each key can contain name, raw value, and optional translation.

• metricTimestamp: timestamp for the aggregate bucket when time bucketing was requested.

• values: aggregated metric values, with metric name, numeric value, and optional unit.

• metricDescriptorID: descriptor identifier. It is not a user-facing metric value.

Usage Notes

• The LLM should use generateProcessingEventsPerFilterMetricAggregationQuery before executing the aggregation so metric values, grouping, time bucketing, and enum values are validated.

• Use sum for totals, avg for arithmetic averages, min and max for extremes, and wavg only when the user asks for or needs a weighted average.

• When wavg is used, weightByValue must identify the metric value that supplies the weight.

• For time bucketing, choose a resolution that produces at most 10000 buckets over the selected time range.

• Use translation for display when available, but preserve raw key values when exact identifiers matter.

• Do not combine or infer aggregate records that are not present in the response.