list_alert_comments
Retrieve all comments for a specific alert within Panther MCP Server, including details like comment ID, text, timestamp, creator, and format, with customizable limits.
Instructions
Get all comments for a specific Panther alert.
Returns: Dict containing: - success: Boolean indicating if the request was successful - comments: List of comments if successful, each containing: - id: The comment ID - body: The comment text - createdAt: Timestamp when the comment was created - createdBy: Information about the user who created the comment - format: The format of the comment (HTML or PLAIN_TEXT or JSON_SCHEMA) - message: Error message if unsuccessful
Permissions:{'all_of': ['Read Alerts']}
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| alert_id | Yes | The ID of the alert to get comments for | |
| limit | No | Maximum number of comments to return |
Implementation Reference
- The complete handler implementation for the 'list_alert_comments' MCP tool, including schema validation via Annotated Pydantic fields, @mcp_tool registration decorator with permissions, and the core logic to fetch alert comments via REST API.@mcp_tool( annotations={ "permissions": all_perms(Permission.ALERT_READ), "readOnlyHint": True, } ) async def list_alert_comments( alert_id: Annotated[ str, Field(min_length=1, description="The ID of the alert to get comments for"), ], limit: Annotated[ int, Field(description="Maximum number of comments to return", ge=1, le=50), ] = 25, ) -> dict[str, Any]: """Get all comments for a specific Panther alert. Returns: Dict containing: - success: Boolean indicating if the request was successful - comments: List of comments if successful, each containing: - id: The comment ID - body: The comment text - createdAt: Timestamp when the comment was created - createdBy: Information about the user who created the comment - format: The format of the comment (HTML or PLAIN_TEXT or JSON_SCHEMA) - message: Error message if unsuccessful """ logger.info(f"Fetching comments for alert ID: {alert_id}") try: params = {"alert-id": alert_id, "limit": limit} async with get_rest_client() as client: result, status = await client.get( "/alert-comments", params=params, expected_codes=[200, 400], ) if status == 400: logger.error(f"Bad request when fetching comments for alert ID: {alert_id}") return { "success": False, "message": f"Bad request when fetching comments for alert ID: {alert_id}", } comments = result.get("results", []) logger.info( f"Successfully retrieved {len(comments)} comments for alert ID: {alert_id}" ) return { "success": True, "comments": comments, "total_comments": len(comments), } except Exception as e: logger.error(f"Failed to fetch alert comments: {str(e)}") return { "success": False, "message": f"Failed to fetch alert comments: {str(e)}", }