POC from SIEM (status)
log10x_poc_from_siem_statusRetrieve progress or rendered report views for a submitted SIEM cost-reduction POC using a snapshot_id; poll in-progress status, then choose summary, full, YAML, configs, top, or pattern output.
Instructions
Retrieve progress or a view of the report from a log10x_poc_from_siem_submit run. Pass snapshot_id; optionally view to select the level of detail. In-progress responses report status (pulling / templatizing / rendering), progress_pct, step_detail, and elapsed_seconds: poll every ~30s until done. Complete responses render one of six views: summary (default, ~30 lines, exec banner + top-5 wins + views CTA), full (complete 9-section report, ~300 lines), yaml (paste-ready Receiver mute-file for the top N patterns), configs (native SIEM exclusion configs, Datadog exclusion filter / Splunk props.conf / etc.), top (expanded N-row drivers table), pattern (deep-dive on one identity, requires pattern arg). Failures include partial_report_markdown when any events were successfully pulled before the error. The full report is also written to ${LOG10X_REPORT_DIR:-/tmp/log10x-reports}/poc_from_siem-.md regardless of which view the caller requested. Snapshots live in-memory per MCP process; a restart clears them, so persist the final report path to keep it. Unified envelope: response carries status, query_count, total_latency_ms, backend_pressure_hint, human_summary, plus the existing snapshot-lifecycle fields. Errors (unknown snapshot_id, render failure) come back as status: 'error' with a structured PrimitiveError envelope. See docs/cross-pillar-primitives.md for the agent behavior contract. Two modes, and the agent should name whichever the user's phrasing invites. This tool is the NETWORKED one: it reads the analyzer directly over the network with the caller's credentials, and the MCP mints one licence. The FENCED mode runs the same POC with no network at all: log10x_emit_sample_plan renders a read-only export script the user runs themselves, and the analysis happens in a container started with --network none, so 'cannot exfiltrate' is a kernel fact the user checks with one docker inspect rather than a claim we make. Offer it; do not ask which one first.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | How to surface the report. Default `summary` returns the v2 structured envelope (`data.result` carries the full JSON: input section with scale + methodology + coverage, output section with aggregates, incidents, per-pattern actions). The agent reads this directly and writes prose in its own voice: no rendered markdown is included in the summary path. Use `markdown` to receive the rendered 9-section markdown report (legacy / human-readable surface). `yaml` returns paste-ready receiver mute-file entries; `configs` returns native SIEM exclusion configs; `top` returns an expanded N-row drivers markdown; `pattern` deep-dives on one identity (requires `pattern` arg). `full` is kept as an alias for `markdown`. | summary |
| top_n | No | Number of rows for views that accept it (`top`, `yaml`, `configs`, `summary`). Defaults: summary=5, top=20, yaml/configs=5. | |
| pattern | No | Required when view="pattern". The snake_case pattern identity to expand. Pass the raw identity as printed in prior views. | |
| snapshot_id | Yes | Snapshot id returned by log10x_poc_from_siem_submit. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| data | No | ||
| tool | Yes | ||
| view | No | summary | |
| images | No | ||
| actions | No | ||
| summary | Yes | ||
| warnings | No | ||
| truncated | No | ||
| next_cursor | No | ||
| render_hint | No | ||
| generated_at | Yes | ||
| schema_epoch | Yes | ||
| schema_version | Yes |