opencdr_detections_feed
Read a bounded page of signals and correlated alerts in durable commit order, using a cursor to resume safely without resetting on retention gaps.
Instructions
Read a bounded page of signals and correlated alerts in durable commit order.
Requires an IAM Core connection advertising detection_feed 1.x. In Fleet mode select one agent_id; this forwards a read, not a fleet-wide central search. Reading does not acknowledge delivery. Retention gaps are returned as errors; never silently reset a cursor. start=latest deliberately skips retained records and cannot be combined with a cursor.
In fleet mode, supply agent_id explicitly. Core mode leaves agent_id unset.
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "opencdr_detections_feed"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| start | No | earliest | |
| cursor | No | ||
| agent_id | No |