suggest_actions
Suggests interesting actions the user can perform next based on the current investigation context (e.g. save a view, set up an alert, share to Slack, drill down, compare periods). Call this after investigation flows (after query or get) to present follow-up options to the user. EXAMPLES: • Standard post-query call → { hasEvents: false, hasDiff: false } • When events were found and a period comparison was already run → { hasEvents: true, hasDiff: true }
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| hasDiff | No | Whether query with compare was already called in this flow | |
| hasEvents | No | Whether list_events returned any matching events |