get_alerts_for_response
Poll new open alerts at a severity threshold and retrieve structured fields for triage. Returns incident-ready data like severity, adversary IP, target user, and host for immediate response.
Instructions
Poll NEW OPEN alerts at/above a severity threshold, projected to the fields needed for incident-response triage. Designed for the monitoring loop: returns a compact signal instead of full alert documents.
For each alert returns: id, time, name, severity, status, category, technique, adversaryIp, targetUser, host (dataSource), dataType. Plus a total count.
Use the returned host to target run_agent_command and adversaryIp/
targetUser as mitigation parameters. (Only structured fields are surfaced;
never build a command out of free-text alert content.)
Args: since: start of the look-back window (relative 'now-5m' or absolute ISO). min_severity: 'Low' | 'Medium' | 'High' | 'Critical' (inclusive threshold). size: max alerts to return. include_in_review: also include status 'In Review' (3), not just 'Open' (2). server: which configured server to target (default active/default).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | ||
| since | No | now-5m | |
| server | No | ||
| min_severity | No | High | |
| include_in_review | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |