alertStatistics
Analyze and aggregate security alert statistics by time range, field, and index pattern using OpenSearch MCP Server for actionable insights.
Instructions
Get statistics about security alerts
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| field | No | Field to aggregate by | rule.level |
| index | No | Index pattern | wazuh-alerts-* |
| timeRange | No | Time range (e.g., 1h, 24h, 7d) | 24h |
Input Schema (JSON Schema)
{
"$schema": "http://json-schema.org/draft-07/schema#",
"additionalProperties": false,
"properties": {
"field": {
"default": "rule.level",
"description": "Field to aggregate by",
"type": "string"
},
"index": {
"default": "wazuh-alerts-*",
"description": "Index pattern",
"type": "string"
},
"timeRange": {
"default": "24h",
"description": "Time range (e.g., 1h, 24h, 7d)",
"type": "string"
}
},
"type": "object"
}