add_alert_comment
Add Markdown-formatted comments to security alerts in Panther MCP Server to provide context, updates, or insights during investigations. Requires 'Manage Alerts' permission.
Instructions
Add a comment to a Panther alert. Comments support Markdown formatting.
Returns: Dict containing: - success: Boolean indicating if the comment was added successfully - comment: Created comment information if successful - message: Error message if unsuccessful
Permissions:{'all_of': ['Manage Alerts']}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alert_id | Yes | The ID of the alert to comment on | |
| comment | Yes | The comment text to add |
Implementation Reference
- Full implementation of the add_alert_comment MCP tool. The @mcp_tool decorator handles registration and specifies required permissions (ALERT_MODIFY) and hints (destructive). Parameter schema is defined via Pydantic's Annotated with Field validators. The handler logic uses the REST client to POST a new comment to the /alert-comments endpoint, handling 404 (alert not found), 400 (bad request), and other errors gracefully.@mcp_tool( annotations={ "permissions": all_perms(Permission.ALERT_MODIFY), "destructiveHint": True, } ) async def add_alert_comment( alert_id: Annotated[ str, Field(min_length=1, description="The ID of the alert to comment on"), ], comment: Annotated[ str, Field(min_length=1, description="The comment text to add"), ], ) -> dict[str, Any]: """Add a comment to a Panther alert. Comments support Markdown formatting. Returns: Dict containing: - success: Boolean indicating if the comment was added successfully - comment: Created comment information if successful - message: Error message if unsuccessful """ logger.info(f"Adding comment to alert {alert_id}") try: # Prepare request body body = { "alertId": alert_id, "body": comment, "format": "PLAIN_TEXT", # Default format } # Execute the REST API call async with get_rest_client() as client: comment_data, status = await client.post( "/alert-comments", json_data=body, expected_codes=[200, 400, 404] ) if status == 404: logger.error(f"Alert not found: {alert_id}") return { "success": False, "message": f"Alert not found: {alert_id}", } if status == 400: logger.error(f"Bad request when adding comment to alert {alert_id}") return { "success": False, "message": f"Bad request when adding comment to alert {alert_id}", } logger.info(f"Successfully added comment to alert {alert_id}") return { "success": True, "comment": comment_data, } except Exception as e: logger.error(f"Failed to add alert comment: {str(e)}") return { "success": False, "message": f"Failed to add alert comment: {str(e)}", }