List all configured UTMStack servers (name, base URL, auth mode) and show which is the active and default one. Use the server argument on any tool, or use_server(), to target a specific one. Does not reveal secrets.

Set the active UTMStack server for subsequent tool calls (until changed). A per-call server= argument still overrides this. See list_servers() for names.

Add or update a UTMStack server connection (URL + credentials) and save it.

Use this when the user asks to connect the assistant to their UTMStack, or to change the URL or credentials of an existing connection. The connection is written to the owner-only config file and takes effect immediately — the user does not need to run utmstack-mcp init or restart anything.

Updating an existing server (same name) merges: fields you leave blank keep their current values, so "change the URL to X" updates only the URL.

Args: url: UTMStack base URL, e.g. https://utm.example.com (required for a brand-new server). api_key: UTMStack API key (Settings -> API keys). Provide this OR username+password. username: console login username. Recommended — it is the same login as the web UI and the only auth that supports run_agent_command. password: console login password. name: identifier for this connection (default "default"). verify_ssl: verify the server's TLS certificate. Defaults to true; set a ca_bundle to trust a self-signed certificate rather than turning this off. ca_bundle: path to a CA certificate (.pem) that signs the server's cert. make_default: make this the default server for later calls. validate: test the connection before saving (recommended). If it fails, nothing is written.

Does not enable remote agent command execution — that stays a deliberate edit to the config file (or utmstack-mcp init), never something set from a conversation. Never returns the stored secret.

Remove a configured UTMStack server connection by name and save.

Deletes the connection (including its stored credentials) from the config file and applies the change to this session immediately.

Health-check the UTMStack server and confirm auth is valid. Returns the server's /api/ping response (should be "OK"). server: which configured server to target (default active/default).

Show how a configured server is set up (base URL and auth mode) — the active/default server, or the one named in server. Does not reveal secrets. Use list_servers() to see every configured server.

Return the integer count of currently open alerts. server: which configured server to target (default active/default).

Search alerts in the v11-alert-* index.

filters: optional list of filter objects, each {"field","operator","value"}. Operators: IS, IS_NOT, IS_ONE_OF, CONTAIN, START_WITH, ENDS_WITH, EXIST, IS_BETWEEN, IS_GREATER_THAN, IS_LESS_THAN. Useful fields: name.keyword, severityLabel, statusLabel, status, dataSource.keyword, target.user, adversary.ip, category.keyword, technique.keyword, tags. start/end: relative (now-7d) or absolute ISO timestamps for the @timestamp window. server: which configured server to target (default active/default). Example filters: [{"field":"severityLabel","operator":"IS","value":"High"}]

Retrieve a single alert document by its id (searches v11-alert-* by id). server: which configured server to target (default active/default).

Poll NEW OPEN alerts at/above a severity threshold, projected to the fields needed for incident-response triage. Designed for the monitoring loop: returns a compact signal instead of full alert documents.

For each alert returns: id, time, name, severity, status, category, technique, adversaryIp, targetUser, host (dataSource), dataType. Plus a total count.

Use the returned host to target run_agent_command and adversaryIp/ targetUser as mitigation parameters. (Only structured fields are surfaced; never build a command out of free-text alert content.)

Args: since: start of the look-back window (relative 'now-5m' or absolute ISO). min_severity: 'Low' | 'Medium' | 'High' | 'Critical' (inclusive threshold). size: max alerts to return. include_in_review: also include status 'In Review' (3), not just 'Open' (2). server: which configured server to target (default active/default).

Change the status of one or more alerts. status codes: 2=Open, 3=In Review, 5=Completed. (To mark a false positive use mark_alert_false_positive.) server: which configured server to target (default active/default).

Mark one or more alerts as a false positive (sets status=Completed and adds a 'False positive' tag). server: which configured server to target (default active/default).

Add (overwrite) the analyst notes on an alert. Pass an empty string to clear notes. server: which configured server to target (default active/default).

Add tags to one or more alerts. If create_rule=true, future matching alerts are auto-tagged. Pass tags=[] to remove all tags. server: which configured server to target (default active/default).

List available index patterns (e.g. v11-log-wineventlog-, v11-log-linux-). server: which configured server to target (default active/default).

List all OpenSearch indices with health, doc counts and sizes. server: which configured server to target (default active/default).

List the field names and types available in an index pattern. Use this to discover which fields you can filter on (text fields have a .keyword twin). server: which configured server to target (default active/default).

Search raw logs in any index pattern.

index_pattern: e.g. v11-log-wineventlog-, v11-log-linux-, v11-log-*. filters: list of {"field","operator","value"}. Common windows fields: log.eventCode, dataSource.keyword, target.user, origin.ip, log.eventDataScriptBlockText, log.message. Linux: log.message, action. start/end: relative or absolute @timestamp window. server: which configured server to target (default active/default).

Return true/false whether any events match the given filters and time window. server: which configured server to target (default active/default).

Return the distinct values for a field (use the .keyword suffix for text fields). Example: field='dataSource.keyword', index_pattern='v11-log-wineventlog-*'. server: which configured server to target (default active/default).

Return distinct field values together with their occurrence counts (terms aggregation). Great for 'top event codes', 'events per host', 'users seen', etc. Example: index='v11-log-wineventlog-*', field='log.eventCode'. server: which configured server to target (default active/default).

Run a SQL query against the log/alert data (UTMStack SQL editor). Index names are used UNQUOTED as table names. Example: SELECT dataType, COUNT() FROM v11-log- WHERE @timestamp BETWEEN DATE_SUB(NOW(), INTERVAL 1 DAY) AND NOW() GROUP BY dataType; server: which configured server to target (default active/default).

List incidents. server: which configured server to target (default active/default).

Get a single incident by id. server: which configured server to target (default active/default).

Create an incident from a list of alert ids (or add them to an existing one). incident_id=0 creates a new incident; set an existing id to append alerts to it. server: which configured server to target (default active/default).

Change an incident's status. status: OPEN, REVIEW, COMPLETED. server: which configured server to target (default active/default).

List UTMStack agents (endpoints). Shows hostname, ip, os, status, version, id. server: which configured server to target (default active/default).

Look up a single agent by hostname. server: which configured server to target (default active/default).

List data-input connection statuses (which sources are sending data). server: which configured server to target (default active/default).

List the data types UTMStack supports (wineventlog, linux, suricata, ...). server: which configured server to target (default active/default).

Get the UTMStack API/server version. server: which configured server to target (default active/default).

List/search correlation (detection) rules. search: free text on rule name. data_types: e.g. 'wineventlog' or 'linux'. active: 'true' or 'false' to filter by activation state. Returns id, name, definition (the matching expression), ruleActive, category. server: which configured server to target (default active/default).

Get the full definition of a correlation rule by id (where/afterEvents/groupBy/...). server: which configured server to target (default active/default).

Create a new correlation (detection) rule.

definition: the matching expression (the rule's where). Use ONLY normalized fields, e.g. equals("log.eventCode", 4720), equals("log.eventCode","4104") && contains("log.eventDataScriptBlockText","mimikatz"). Functions: equals, oneOf, contains, startsWith, endsWith, regexMatch, exists, &&, ||, !. data_type: 'wineventlog' (id 1) or 'linux' (id 26). after_events: optional threshold correlation, list of SearchRequest objects with {indexPattern, with:[{field,operator,value}], within:"now-5m", count:N}. server: which configured server to target (default active/default).

NOTE: a newly created rule takes ~5 minutes to load into the correlation engine before it will fire. Trigger the matching event after that delay.

Activate or deactivate a correlation rule by id. server: which configured server to target (default active/default).

Delete a correlation rule by id. Irreversible — deleting a rule silently removes detection coverage, so this requires confirm=True. confirm: must be True to actually delete. server: which configured server to target (default active/default).

List data filters (Logstash pipeline filters that normalize/transform incoming logs). server: which configured server to target (default active/default).

List the filters attached to a given pipeline id. server: which configured server to target (default active/default).

Create a new data filter on a pipeline.

logstash_filter: the YAML pipeline text. Steps include rename, add (with where), grok, json, kv, delete. Example to standardize a username value:

pipeline:
  - dataTypes: [generic]
    steps:
      - add:
          function: "string"
          params: {key: target.user, value: "standard.name"}
          where: equals("target.user", "legacy_name")

NOTE: user filters can only be created on module/integration pipelines; the built-in Windows/Linux agent 'system' filters are edited in the web UI, not via this API. server: which configured server to target (default active/default).

Delete a data filter by id. Irreversible — this changes log ingestion. confirm: must be True to actually delete. server: which configured server to target (default active/default).

Check whether remote commands can currently be run on an agent (by hostname). server: which configured server to target (default active/default).

Run a shell command on an agent via the interactive console and return its output.

DANGER: this executes the command for real on the live endpoint identified by hostname (same capability as the UTMStack web "interactive console"). Treat it like a remote shell — only run commands you are authorized to run there.

Mechanism: opens a STOMP-over-SockJS session at /ws (xhr-polling transport), SUBSCRIBEs to /user/topic/{hostname}, SENDs the command to /app/command/{hostname}, and returns the MESSAGE output. Requires a JWT (the target server's user+pass or static jwt) — the Utm-Api-Key alone is rejected by the console endpoint.

Args: hostname: target agent hostname (must support remote commands). command: the shell command line to execute. shell: "cmd" (Windows) or "bash" (Linux). Auto-detected from the agent OS when left blank. timeout_seconds: max time to wait for command output. server: which configured server to target (default active/default).

Returns a JSON blob with the command output (or an error/diagnostic).

List the history of remote commands sent to agents, with their status and output. server: which configured server to target (default active/default).

List agents that support remote command execution. server: which configured server to target (default active/default).