wazuh_list_alerts
Query Wazuh security alerts using filters like agent ID, rule level, MITRE technique, or free-text search. Enables incident triage, threat hunting, and security event overview.
Instructions
Query Wazuh security alerts with powerful filters. Use this to triage incidents, hunt for specific threat patterns, or get an overview of recent security events.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | No | Filter alerts to a specific agent ID (e.g., '001') | |
| agents_list | No | Comma-separated agent IDs to filter (e.g., '001,002,003') | |
| min_level | No | Minimum rule level (3-15). Higher = more severe. Use 12+ for critical only. | |
| rule_id | No | Filter by a specific Wazuh rule ID (e.g., '5710' for SSH brute force) | |
| rule_ids | No | Comma-separated rule IDs (e.g., '5710,5712,5760') | |
| mitre_id | No | Filter by MITRE ATT&CK technique ID (e.g., 'T1110' for brute force) | |
| search | No | Free-text search across alert fields (IP, hostname, command, etc.) | |
| sort | No | Sort field, prefix with '-' for descending (e.g., '-timestamp') | |
| limit | No | Maximum number of alerts to return (1-500) | |
| offset | No | Pagination offset for scrolling through results |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |