Search Taegis alerts using OCSF query syntax.

Args: query: OCSF query string, e.g. "FROM alert EARLIEST=-1d WHERE severity='High'" region: Taegis environment/region (charlie, delta, us1, us2, eu …). Defaults to the TAEGIS_ENVIRONMENT env var, then "charlie". limit: Maximum number of results to return (default 100, max 10 000).

Returns: JSON array of alert objects.

Search Taegis security events.

Args: query: Event query string. region: Taegis environment/region. Defaults to TAEGIS_ENVIRONMENT or "charlie". limit: Maximum number of results (default 100).

Returns: JSON array of event objects.

List and search open security investigations in Taegis.

Args: region: Taegis environment/region. Defaults to TAEGIS_ENVIRONMENT or "charlie". limit: Maximum number of investigations to return (default 25).

Returns: JSON array of investigation objects.

List all Taegis tenants visible to the authenticated user.

Returns: JSON array of tenant objects.

Search Taegis threat intelligence (IOCs, hashes, IPs, domains …).

Args: query: Search query — indicator value or free-text search. region: Taegis environment/region. Defaults to TAEGIS_ENVIRONMENT or "charlie".

Returns: JSON array of threat intelligence objects.

Run an arbitrary taegis CLI command and return JSON output.

Use this as an escape hatch for commands not yet wrapped as dedicated tools (e.g. "rules search --region charlie").

Args: args: Space-separated CLI arguments after the taegis binary, e.g. "audits search --region charlie --limit 10".

Returns: Raw JSON output from the taegis CLI.