get_alert

Instructions

Implementation Reference

• src/tools/alerts.ts:109-173 (registration)

  Registration of the 'get_alert' tool via server.tool(), defining its name, description, schema, and handler

  server.tool(
    "get_alert",
    "Retrieve a single security alert by its ID",
    {
      alert_id: z
        .string()
        .describe("Alert identifier"),
    },
    async ({ alert_id }) => {
      if (!indexerClient) {
        return {
          content: [{ type: "text" as const, text: JSON.stringify({ error: NO_INDEXER_MSG }) }],
          isError: true,
        };
      }
  
      try {
        const alert = await indexerClient.getAlert(alert_id);
  
        if (!alert) {
          return {
            content: [
              {
                type: "text" as const,
                text: JSON.stringify({ error: `Alert '${alert_id}' not found` }),
              },
            ],
            isError: true,
          };
        }
  
        const result = {
          id: alert.id,
          timestamp: alert.timestamp,
          rule_id: alert.rule?.id,
          rule_level: alert.rule?.level,
          rule_description: alert.rule?.description,
          rule_groups: alert.rule?.groups,
          agent_id: alert.agent?.id,
          agent_name: alert.agent?.name,
          location: alert.location,
          decoder: alert.decoder?.name,
          full_log: alert.full_log,
          mitre: alert.rule?.mitre,
          data: alert.data,
        };
  
        return {
          content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify({
                error: error instanceof Error ? error.message : String(error),
              }),
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/alerts.ts:117-173 (handler)

  Handler function that validates indexerClient exists, calls indexerClient.getAlert(alert_id), checks for null result, and returns formatted alert data

    async ({ alert_id }) => {
      if (!indexerClient) {
        return {
          content: [{ type: "text" as const, text: JSON.stringify({ error: NO_INDEXER_MSG }) }],
          isError: true,
        };
      }
  
      try {
        const alert = await indexerClient.getAlert(alert_id);
  
        if (!alert) {
          return {
            content: [
              {
                type: "text" as const,
                text: JSON.stringify({ error: `Alert '${alert_id}' not found` }),
              },
            ],
            isError: true,
          };
        }
  
        const result = {
          id: alert.id,
          timestamp: alert.timestamp,
          rule_id: alert.rule?.id,
          rule_level: alert.rule?.level,
          rule_description: alert.rule?.description,
          rule_groups: alert.rule?.groups,
          agent_id: alert.agent?.id,
          agent_name: alert.agent?.name,
          location: alert.location,
          decoder: alert.decoder?.name,
          full_log: alert.full_log,
          mitre: alert.rule?.mitre,
          data: alert.data,
        };
  
        return {
          content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
        };
      } catch (error) {
        return {
          content: [
            {
              type: "text" as const,
              text: JSON.stringify({
                error: error instanceof Error ? error.message : String(error),
              }),
            },
          ],
          isError: true,
        };
      }
    }
  );

• src/tools/alerts.ts:112-116 (schema)

  Input schema for get_alert: requires a single string parameter 'alert_id'

  {
    alert_id: z
      .string()
      .describe("Alert identifier"),
  },

• src/indexer-client.ts:179-188 (helper)

  Indexer client helper that queries OpenSearch by alert ID and maps the result to a WazuhAlert object

  async getAlert(id: string): Promise<WazuhAlert | null> {
    const body = {
      query: { ids: { values: [id] } },
      size: 1,
    };
  
    const result = await this.post<OpenSearchResponse>("/wazuh-alerts-*/_search", body);
    if (result.hits.hits.length === 0) return null;
    return this.mapHitToAlert(result.hits.hits[0]);
  }

• src/index.ts:40-49 (registration)

  Registration call where registerAlertTools is invoked during server setup with server, client, and indexerClient

  registerAlertTools(server, client, indexerClient);
  registerRuleTools(server, client);
  registerDecoderTools(server, client);
  registerVersionTools(server, client);
  registerScaTools(server, client);
  registerSyscollectorTools(server, client);
  registerRootcheckTools(server, client);
  registerSyscheckTools(server, client);
  registerManagerTools(server, client);
  registerGroupTools(server, client);