search_alerts
Search for security alerts in the SIEM index using custom filters, time ranges, and pagination to investigate potential threats.
Instructions
Search alerts in the v11-alert-* index.
filters: optional list of filter objects, each {"field","operator","value"}. Operators: IS, IS_NOT, IS_ONE_OF, CONTAIN, START_WITH, ENDS_WITH, EXIST, IS_BETWEEN, IS_GREATER_THAN, IS_LESS_THAN. Useful fields: name.keyword, severityLabel, statusLabel, status, dataSource.keyword, target.user, adversary.ip, category.keyword, technique.keyword, tags. start/end: relative (now-7d) or absolute ISO timestamps for the @timestamp window. server: which configured server to target (default active/default). Example filters: [{"field":"severityLabel","operator":"IS","value":"High"}]
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | now | |
| page | No | ||
| size | No | ||
| sort | No | @timestamp,desc | |
| start | No | now-24h | |
| server | No | ||
| filters | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |