wazuh-daily-triage

search_alerts

Read-only

Search the Wazuh alerts index to retrieve compact raw event samples, filtered by time, agent, rule, level, or Lucene query for daily triage.

Instructions

Search the alerts index; returns compact events (max 25). Use it to look at raw samples.

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "search_alerts"
  }
}

Input Schema

Name	Required	Description
`to`	No	End: ISO-8601 or now. Default now
`env`	No	environment id (list_environments)
`from`	No	Start: ISO-8601 or OpenSearch date math (now-24h). Default now-24h
`size`	No
`agent`	No	Agent name (agent.name) filter
`query`	No	Optional Lucene query_string, e.g. data.srcip:192.0.2.10 AND rule.groups:sshd
`rule_ids`	No	Rule ID filter
`min_level`	No	Minimum rule.level
`oldest_first`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.10.1Nov 10, 2026

TDQS

A3.5/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds the valuable 25-event cap and the "compact events" return shape, but omits pagination behavior, sort order despite an oldest_first param, and what happens when results exceed the cap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short sentence plus one usage sentence, front-loaded with the verb and resource and the key output constraint. Slight waste in restating the tool's purpose as "search the alerts index" without further qualification.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter search tool with no output schema, the definition covers the core behavior and result cap but is thin on return-field composition, default sort order, and how filtering parameters combine. No output schema means the description should say more about what a "compact event" contains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 78%, so most parameters (to, from, env, agent, query, rule_ids, min_level) are documented inline. The description adds no per-parameter detail, but with high coverage the baseline applies; the undocumented size and oldest_first params are self-explanatory but unclarified regarding the 25-cap interaction.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: search the alerts index, returning compact events capped at 25. It does not name a sibling alternative, though aggregate_alerts in the catalog is the obvious contrasting tool for counting versus sampling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Use it to look at raw samples" gives implied usage guidance for exploratory inspection, but never says when not to use it (e.g., for aggregation, use aggregate_alerts) or what the 25-cap means for large result sets.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server