Panther MCP Server

Get events for a specific Panther alert by ID. We make a best effort to return the first events for an alert, but order is not guaranteed. This tool does not support pagination to prevent long-running, expensive queries. Args: alert_id: The ID of the alert to get events for limit: Maximum number of events to return (default: 10, maximum: 10) Returns: Dict containing: - success: Boolean indicating if the request was successful - events: List of most recent events if successful - message: Error message if unsuccessful

{ "properties": { "alert_id": { "title": "Alert Id", "type": "string" }, "limit": { "default": 10, "title": "Limit", "type": "integer" } }, "required": [ "alert_id" ], "type": "object" }