Panther MCP Server

Args: alert_ids: List of alert IDs to update. Can be a single ID or multiple IDs. status: The new status for the alerts. Must be one of: - "OPEN": Alert is newly created and needs investigation - "TRIAGED": Alert is being investigated - "RESOLVED": Alert has been investigated and resolved - "CLOSED": Alert has been closed (no further action needed) Returns: Dict containing: - success: Boolean indicating if the update was successful - alerts: List of updated alerts if successful, each containing: - id: The alert ID - status: The new status - updatedAt: Timestamp of the update - message: Error message if unsuccessful Example: # Update a single alert result = await update_alert_status(["alert-123"], "TRIAGED") # Update multiple alerts result = await update_alert_status(["alert-123", "alert-456"], "RESOLVED")

{ "properties": { "alert_ids": { "items": { "type": "string" }, "title": "Alert Ids", "type": "array" }, "status": { "title": "Status", "type": "string" } }, "required": [ "alert_ids", "status" ], "type": "object" }