Skip to main content
Glama
WYRE-AI

avanan-mcp

by WYRE-AI
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

hec_query_events

Query Checkpoint Harmony Email security events by type, state, severity, date range, or SaaS platform. Retrieve phishing, malware, DLP, and anomaly events with available remediation actions.

Instructions

Query Checkpoint Harmony Email security events (phishing, malware, DLP, anomaly, shadow IT, etc.). Supports filtering by type, state, severity, date range, and SaaS platform. Returns events with available remediation actions.

Input Schema

NameRequiredDescriptionDefault
saasNoFilter by SaaS platform(s)
endDateNoEnd date/time (ISO 8601). Defaults to now.
eventIdsNoFetch specific event IDs
scrollIdNoScroll ID for pagination (from previous response)
startDateNoStart date/time (ISO 8601, e.g. 2026-01-01T00:00:00Z)
eventTypesNoFilter by event type(s)
severitiesNoFilter by severity level(s) (e.g. Critical, High, Medium, Low)
eventStatesNoFilter by event state(s). Defaults to new/detected if omitted.

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed1 schema field changedv2.2.5
    • changedInput schema / properties / eventTypes / items / enum
      Previous value: -[
-  "phishing",
-  "malware",
-  "suspicious malware",
-  "dlp",
-  "anomaly",
-  "shadow_it",
-  "malicious_url_click",
-  "malicious_url",
-  "alert"
-]New value: +[
+  "phishing",
+  "malware",
+  "suspicious_malware",
+  "suspicious_phishing",
+  "dlp",
+  "anomaly",
+  "shadow_it",
+  "malicious_url_click",
+  "malicious_url",
+  "alert"
+]
  2. Addedv2.2.2
  3. Removedv2.2.1
  4. First observedv1.0.0

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. 'Query' implies a read operation and the return content ('events with available remediation actions') is disclosed, but auth requirements, rate limits, and pagination behavior are not described beyond what the scrollId parameter implies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences with the purpose front-loaded and no filler. The parenthetical category enumeration and trailing 'etc.' are mildly redundant with the schema's enums, keeping this just short of a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description should carry more weight than it does: it gives only a one-line hint about the return shape and says nothing about pagination strategy or result volume. It is adequate for calling the tool but leaves the agent guessing about responses.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all 8 parameters are already documented in the schema. The description's filter summary (type, state, severity, date range, SaaS platform) maps directly onto existing parameters and adds no syntax or format detail beyond it. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Query') and resource ('Checkpoint Harmony Email security events'), and enumerates the event categories covered. It does not explicitly differentiate itself from close siblings like hec_get_event or hec_search_emails, which an agent could confuse with this tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The list of supported filters implies the tool is the general event-query entry point, but there is no explicit when-to-use guidance and no exclusions or named alternatives (e.g. 'for a single event use hec_get_event'). Usage is inferred rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools