Query temporal patterns (event sequence, not motif analysis)
query_temporal_patternsReturns a chronological list of security events with classification and IP details, so you can examine sequences and detect high-priority patterns.
Instructions
Returns events in a time window, ordered chronologically, with their classification, firing policy, and source/dest IPs joined. The AI uses this raw sequence to detect patterns (e.g. config-download + firmware-change + operating-mode-change within minutes = high-priority investigation). The server does NOT detect motifs, score patterns, or label sequences.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| since | Yes | ||
| until | No | ||
| event_types | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||