Analytics Query
analytics_queryAnalyze security posture by querying vulnerability trends, posture history, and runtime event summaries from ClickHouse.
Instructions
Query vulnerability trends, posture history, and runtime event summaries from ClickHouse.
Requires AGENT_BOM_CLICKHOUSE_URL to be set. Returns empty results if
ClickHouse is not configured.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query_type | Yes | Query type: vuln_trends, top_cves, posture_history, event_summary, fleet_riskiest, or compliance_heatmap | |
| days | No | Lookback window in days (default 30). Used by vuln_trends, posture_history, and compliance_heatmap. | |
| hours | No | Lookback window in hours (default 24). Used by event_summary. | |
| agent | No | Filter by agent name. Used by vuln_trends and posture_history. | |
| limit | No | Max results for top_cves and fleet_riskiest (default 20). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |