get_alert_events

Retrieve recent events for a specific alert in Panther's security monitoring platform. Ensures efficient queries by limiting results without pagination, returning success status, event list, or error message.

Instructions

Get events for a specific Panther alert. Order of events is not guaranteed. This tool does not support pagination to prevent long-running, expensive queries.

Returns: Dict containing: - success: Boolean indicating if the request was successful - events: List of most recent events if successful - message: Error message if unsuccessful

Permissions:{'all_of': ['Read Alerts']}

Input Schema

Name	Required	Description	Default
`alert_id`	Yes	The ID of the alert to get events for
`limit`	No	Maximum number of events to return

Input Schema (JSON Schema)

{
  "properties": {
    "alert_id": {
      "description": "The ID of the alert to get events for",
      "minLength": 1,
      "title": "Alert Id",
      "type": "string"
    },
    "limit": {
      "default": 10,
      "description": "Maximum number of events to return",
      "maximum": 50,
      "minimum": 1,
      "title": "Limit",
      "type": "integer"
    }
  },
  "required": [
    "alert_id"
  ],
  "type": "object"
}

Panther MCP Server

get_alert_events

Instructions

Input Schema

Input Schema (JSON Schema)

Other Tools from Panther MCP Server

Related Tools

MCP directory API