listObservables
List and filter Mallory observables, returning lean summaries as {items,total,offset,limit}. Each item includes: observable type (e.g. ip.v4, domain, url, hash.sha256), name/value, and verdict/opinion counts. Filter prefixes: type: (e.g. type:ip or type:ip.v4), name:, uuid:. Sort by uuid, created_at, updated_at, type, name, severity_score, confidence_score. Optional fieldFilters: scope=global|tenant, created_at__gte/__lt, severity_score__gte/__lte, confidence_score__gte/__lte, score_scope=tenant|global (tenant: only observables with the tenant's custom score). Field operators append to a field name with __: strings support __neq, __in, __not_in, __like, __ilike; numbers support __gt, __gte, __lt, __lte. Timestamps (created_at, updated_at) support __gte and __lt ONLY — there is no __gt, __lte, or bare equality on them, so express a range as the half-open created_at__gte=&created_at__lt=. Pass an item's identifier to getObservable for the full detail object.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Field to sort by (see this tool's sort fields). | |
| limit | No | Max items to return (1-100, default 25). | |
| order | No | Sort order (default: desc). | |
| filter | No | Prefix filter string (see this tool's filter prefixes). No prefix = default name/text search. | |
| offset | No | Items to skip, for pagination. | |
| fieldFilters | No | Advanced structured filters as a map of query-param name -> value. Use a bare field for exact match, or a field__operator key for ranges/sets. Field operators append to a field name with `__`: strings support __neq, __in, __not_in, __like, __ilike; numbers support __gt, __gte, __lt, __lte. Timestamps (created_at, updated_at) support __gte and __lt ONLY — there is no __gt, __lte, or bare equality on them, so express a range as the half-open created_at__gte=<start>&created_at__lt=<end>. |