keep_enrich_alert
Add string enrichment key-value data to a Keep alert by fingerprint, with an optional dry-run preview via omitted confirm. Use it to attach context for triage before executing the write.
Instructions
Enrich an alert. POST /alerts/enrich with fingerprint and a string enrichments map. Optional dispose_on_new_alert (API default false). Omit confirm for a dry-run preview.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"fingerprint": "<fingerprint>",
"enrichments": "<enrichments>"
},
"name": "keep_enrich_alert"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Set to the boolean true to execute the write. Omit this field for a dry-run preview. false and the string true are rejected. | |
| enrichments | Yes | String enrichment map. Keep's EnrichAlertRequestBody uses dict[str, str]. | |
| fingerprint | Yes | Keep alert fingerprint. | |
| dispose_on_new_alert | No | Keep query flag. API default is false. |