saas_alerts_events_query_advanced
Execute custom Elasticsearch queries against SaaS Alerts events to search and analyze security events with full query control.
Instructions
Execute an advanced Elasticsearch query against the SaaS Alerts events index. Accepts a raw Elasticsearch query body for maximum flexibility.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Elasticsearch query body (e.g. { "query": { "term": { "alertStatus": "critical" } } }) |