event_list
Retrieve engine events filtered by severity and recency, with pagination and incremental fetch for new events.
Instructions
[READ] Engine events at or above a severity, newest first.
To follow new events, pass the highest index you have already seen as
after_index: events after it come back OLDEST first (order), so repeat with the
highest index returned while truncated is true and nothing is skipped.
since_minutes keeps events from the last N minutes and sets scanTruncated when
older ones in the window may be missing. SSO session ids in login events are
redacted.
Args:
limit: Rows to return, 1-1000 (default 100); truncated says when more exist.
min_severity: One of normal, warning, error, alert (default normal).
page: Older pages of events (not combinable with since_minutes or after_index).
after_index: Only events with a higher index than this, oldest first.
since_minutes: Only events from the last N minutes (1-129600).
target: Engine target name from config; omit to use the default.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | ||
| limit | No | ||
| target | No | ||
| after_index | No | ||
| min_severity | No | normal | |
| since_minutes | No |