MCP Tool Reference

The Ingext MCP server exposes 51 tools in 11 groups: 39 read-only, 9 that change state, and 3 that delete. This page lists each tool with its effect and its parameters. Connecting a client, permissions, and the common call sequences are on MCP Server.

Parameter tables follow each tool's JSON input schema. A parameter written parent[].child is a field of each object in the parent list; parent.child is a field of the parent object. Times written as epoch milliseconds are Unix time in milliseconds, such as 1767225600000 for 2026-01-01 00:00 UTC.

Effect	Meaning
Read	No side effects.
Write	Creates, changes, runs, or sends something.
Delete	Removes something permanently.

Discover data

Find out what the account holds before querying it: the datalake tables, the lookup tables a query can join against, the indexes lake_search can read, and the installed integrations.

Related: Data Lake → Management · Schemas · EntityInfo Tables · Platform → Integrations

list_data_tables

Effect: Read

Lists every data table available to query, in two groups:

• streamTables — datalake tables. Query them with kql_search; the table name is the KQL identifier.
• resourceTables — inventory tables synced from a vendor API.

Each entry carries only the table name and a short description. This is the first call when a client needs to know what can be queried. Hand-imported lookup tables are not listed here — see list_entity_tables.

No parameters.

list_entity_tables

Effect: Read

Lists the account's EntityInfo tables — the lookup tables a KQL query joins against for enrichment. That includes the tables Fluency ships and syncs into the account (event-ID descriptions, status codes, watchlists) and any the tenant imported itself.

Each entry carries:

• name — the EntityInfo table name.
• kqlName — the identifier to write in a query, exactly as given. Usually ENTITY_<name>; bracket-quoted as ['ENTITY_<name>'] when the name is not a bare identifier (for example, it contains spaces). An empty kqlName means the table cannot be named in KQL at all and has to be renamed.
• fields — the column names, in CSV order. Every column is a string, so use toint() or todouble() for arithmetic.
• lookupType and mode.

A table imported with no rows is listed here but is missing from the data a query reads, so a query that names it fails.

No parameters.

lake_search_list_index

Effect: Read

Lists the datalake indexes lake_search can read — the authoritative list of what that tool can reach. Reads the managed datalake unless datalake names another.

An index qualifies when its documents are stored whole: it uses the built-in ingext default schema, or its schema declares dynamic=true. Indexes backed by a fixed (non-dynamic) schema are omitted; query those with kql_search instead.

Each entry carries index (the fully qualified <datalake>-<datalakeIndex> name to pass to lake_search), datalake, datalakeIndex, schemaName, dynamic, and description, sorted by qualified name.

Parameter	Type	Required	Description
datalake	string	No	Datalake to enumerate; defaults to managed.

list_integrations

Effect: Read

Lists every installed integration. Each entry carries the integration's id, name, type (for example S3Bucket, Okta, Office365ResourceWatch), description, createdOn, updatedOn, configuration, inUse and plugin flags, and tags. Secret credentials are stripped from the result.

Several tools take an integrationName; this is where those names come from.

No parameters.

Search & query

Query the datalake, the asset inventory, and the audit log.

Related: KQL · Search · Assets Search · Audit

validate_kql

Effect: Read

Parses a KQL query without running it. Returns ok=true, or ok=false with the parser's error message. A client should validate a query before running it with kql_search or handing it to a user.

Parameter	Type	Required	Description
kql	string	Yes	KQL query text to parse (not executed).

kql_search

Effect: Read

Runs a KQL query against the datalake and returns the result inline. The table comes from the query itself (fortigatetraffic | where ...) — find it with list_data_tables and check the syntax with validate_kql first.

rangeFrom and rangeTo set an optional time window in epoch milliseconds. When the query has its own time predicates, those take precedence.

The response carries total, totalBytes, cost, and data — the result set as tables[] with columns and rows. truncated=true means the result is partial, for one of two reasons:

• Rows were clipped at the per-table cap.
• Whole groups were dropped because a summarize exceeded the engine's group cap. A truncated result with far fewer rows than the cap is this kind: narrow the group-by, not the time range.

Either way, the numbers are not complete.

Parameter	Type	Required	Description
kql	string	Yes	KQL query text to execute. The table identifier is taken from the query (e.g. fortigatetraffic | where ...). Call validate_kql first to catch parse errors.
rangeFrom	integer	No	Optional lower bound of the search time window, epoch milliseconds. Omit when the KQL already constrains time.
rangeTo	integer	No	Optional upper bound of the search time window, epoch milliseconds.

lake_search

Effect: Read

Searches one datalake index and returns the raw JSON event documents, with facet counts. Use it for the events themselves, a quick breakdown of values, or a drill-down on exact field values; use kql_search for a computed table (joins, projections, summarize).

Index. Pass an index from lake_search_list_index as given. A bare name is qualified with the datalake (default managed), so Office365 searches managed-Office365; a name that already contains a dash is used as is.

Time window. rangeFrom and rangeTo are required, in epoch milliseconds.

Query. searchStr accepts four forms:

1. Empty — every event in the range.
2. A Lucene query, such as @fields.ClientIP:8.8.8.8 or @source:Audit.Exchange AND @fields.Operation:UserLoggedIn.
3. A single bare term, such as an IP address or hostname. An email address must be double-quoted ("user@example.com"), or the parser splits it on @ and . and matches the wrong documents. A searchStr that is only a bare address is quoted automatically.
4. A regular expression between slashes, such as /test/.

Filters. mustFilters and mustNotFilters each take a list of {field, terms} objects. Terms within one filter are OR'ed; separate filters are AND'ed — for example {field: '@source', terms: ['Audit.AzureActiveDirectory', 'Audit.Exchange']}.

Facets and paging. facets counts the top values of the named fields across the whole match set, facetSize values per field. limit must be at least 1 — there is no facet-only search — and offset + limit may not exceed 5,000. By default, documents sort by @timestamp, newest first.

The response carries total (events matched), filtered (events read and discarded), took, cost, documents (each with the raw event under source), and facets keyed by field — which can include facets the index configures but the call did not ask for. With includeHistogram=true it also returns the non-empty slots of the date histogram over the range.

Parameter	Type	Required	Description
datalake	string	No	Datalake the index belongs to; defaults to managed. Ignored when index already carries a datalake prefix.
facetSize	integer	No	Max value buckets per facet field; defaults to 20.
facets	string[]	No	Fields to count top values on across the whole match set (e.g. ['@fields.UserId','@fields.ClientIP']).
includeHistogram	boolean	No	Also return the date histogram over the range (non-empty slots only); defaults to false.
index	string	Yes	Datalake index to search — the index of a lake_search_list_index entry (e.g. managed-Office365). A bare name (e.g. Office365) is qualified to <datalake>-<index>.
limit	integer	No	Documents to return; defaults to 20, minimum 1 (this endpoint has no facet-only search). offset + limit may not exceed 5000.
mustFilters	object[]	No	Term filters every event must match; terms within one filter are OR'ed, separate filters are AND'ed.
mustFilters[].field	string	Yes	Document field to filter on, e.g. @source or @fields.ClientIP.
mustFilters[].terms	string[]	Yes	Exact terms to match; terms within one filter are OR'ed.
mustNotFilters	object[]	No	Term filters that exclude an event when matched.
mustNotFilters[].field	string	Yes	Document field to filter on, e.g. @source or @fields.ClientIP.
mustNotFilters[].terms	string[]	Yes	Exact terms to match; terms within one filter are OR'ed.
offset	integer	No	Documents to skip (paging); defaults to 0.
rangeFrom	integer	Yes	Start of the search window, epoch milliseconds.
rangeTo	integer	Yes	End of the search window, epoch milliseconds.
searchStr	string	No	Query over the events. Empty matches everything in the range. Accepts a Lucene query (@fields.ClientIP:8.8.8.8), a single bare term (an email address must be double quoted: "user@example.com"), or a regular expression between slashes (/test/).
sortField	string	No	Field to sort documents by; defaults to @timestamp.
sortOrder	string	No	Sort order: asc or desc; defaults to desc.

asset_search

Effect: Read

Searches the global asset inventory — the merged device and host records the platform builds by reconciling every asset provider (endpoint agents, directory syncs, cloud inventories, hosts seen in logs). Use it to list machines, look up one host, or count assets by attribute.

Each asset carries name, fqdn, description, machineType, category, os/osVersion, publicIP/privateIP, vendor, model, uuid, serialNumber, agentID, lastLoggedInUser, cloud fields (region, vpc, account, instanceID), groups, tags, flags, providers (which providers contributed to the record), status (on when active), updatedOn, and id.

query takes a Lucene-style filter. Every string field is indexed as a keyword, so a clause matches the whole value and is case-sensitive — machineType:"Windows Server" AND providers:FPL. Use wildcards for partial matches: name:ENGINEROOM*.

The optional time window applies to updatedOn unless rangeField names another field. Results sort by updatedOn, newest first, 20 per page by default. facets returns value counts for the named keyword fields across the whole match set.

Parameter	Type	Required	Description
facetSize	integer	No	Max buckets per facet field; defaults to 20.
facets	string[]	No	Optional keyword fields to aggregate value counts on (e.g. ['machineType','category','providers','status','groups']); returned under facets alongside the hits.
limit	integer	No	Max assets to return; defaults to 20 server-side when omitted.
offset	integer	No	Number of assets to skip (paging); defaults to 0.
query	string	No	Lucene-style filter on the asset docs (e.g. machineType:"Windows Server" AND providers:FPL); every string field is a keyword so clauses match the whole value and are case-sensitive — use wildcards (name:ENGINEROOM*) for partial matches. Omit to match every asset.
rangeField	string	No	Date field the time window applies to; defaults to updatedOn (when the asset was last refreshed by any provider).
rangeFrom	integer	No	Optional start of the time window on rangeField, epoch milliseconds; only applied when both rangeFrom and rangeTo are set.
rangeTo	integer	No	Optional end of the time window on rangeField, epoch milliseconds; only applied when both rangeFrom and rangeTo are set.
sortField	string	No	Sort field; defaults to updatedOn.
sortOrder	string	No	Sort order: asc or desc; defaults to desc.

audit_search

Effect: Read

Searches the platform's audit log: logins, logouts, user-management actions, and per-API events — the same records as Settings → Management → Audit. Each event carries username, email, role, clientIP, country, city, createdOn (epoch milliseconds), category, action, action_info, an optional error, and a free-form data payload.

query takes a Lucene-style filter, such as username:alice AND category:authentication. The time window is required. Results sort by createdOn, newest first.

Parameter	Type	Required	Description
limit	integer	No	Max hits to return; defaults to 100 server-side when omitted.
offset	integer	No	Number of hits to skip (paging); defaults to 0.
query	string	No	Lucene-style filter on the audit docs (e.g. username:alice AND category:authentication); omit to match everything in the time window.
rangeFrom	integer	Yes	Start of time window, epoch milliseconds (inclusive).
rangeTo	integer	Yes	End of time window, epoch milliseconds (exclusive).
sortField	string	No	Sort field; defaults to createdOn.
sortOrder	string	No	Sort order: asc or desc; defaults to desc.

Behavior & detection

Read behavior summaries and the events behind them, inspect and test eventwatch rules, and investigate a SentinelOne alert.

Related: Behavior Summary · Behavior Timeline · Managing Rules · SentinelOne

behavior_summary_search

Effect: Read

Searches the account's behavior summaries — the incident rows an analyst triages, one per rule-and-entity pair over a time bucket, each with its riskScore, contributing risk factors, and AI-assist verdict. Use it to pull the incident behind an alert or a risk score, and to measure how often a rule fires across entities before treating one firing as meaningful.

rangeFrom and rangeTo are required, in epoch milliseconds, and filter on from.

Summary times are bucket labels

A summary's from and to are two-minute bucket labels produced by the eventwatch engine's buffering window, not the times of the underlying events. They are not an event timeline or a duration. Use behavior_event_search for real event times.

Results sort by riskScore, highest first; sort on to for most recent first. For a cheap base rate, set a wide range, a limit of 0–1, and facets such as ['entityName'] — facet counts cover the whole match set, not only the returned documents.

Parameter	Type	Required	Description
facetSize	integer	No	Max value buckets per facet field; defaults to 20.
facets	string[]	No	Fields to count top values on across the whole match set, e.g. ['ruleName','entityName']. This is how you get a base rate without paging every document.
histogramInterval	string	No	Fixed interval for the histogram, e.g. 1h, 10m, 1d; defaults to 1h. Only used when includeHistogram is true.
includeHistogram	boolean	No	Also return a date histogram over the range (non-empty slots only); defaults to false.
limit	integer	No	Documents to return; defaults to 20. offset + limit may not exceed 10000.
mustFilters	object[]	No	Term filters every document must match; terms within one filter are OR'ed, separate filters are AND'ed.
mustFilters[].field	string	Yes	Field to filter on, e.g. ruleName, entityName or riskLevel.
mustFilters[].terms	string[]	Yes	Exact terms to match; terms within one filter are OR'ed.
mustNotFilters	object[]	No	Term filters that exclude a document when matched.
mustNotFilters[].field	string	Yes	Field to filter on, e.g. ruleName, entityName or riskLevel.
mustNotFilters[].terms	string[]	Yes	Exact terms to match; terms within one filter are OR'ed.
offset	integer	No	Documents to skip (paging); defaults to 0.
rangeFrom	integer	Yes	Start of the search window, epoch milliseconds.
rangeTo	integer	Yes	End of the search window, epoch milliseconds.
searchStr	string	No	Lucene query over the documents, e.g. entityName:"user@example.com" or ruleName:AzureAD_User_Add_Authentication_Method. Empty matches everything in the range. An email address used as a bare term must be double quoted, or the parser splits it on @ and . and matches the wrong documents.
sortField	string	No	Field to sort by. Defaults to riskScore for summaries and timestamp for events. Use to on summaries for most-recent-first.
sortOrder	string	No	Sort order: asc or desc. Defaults to desc.

behavior_event_search

Effect: Read

Searches the account's individual behavior events — the per-event signals a behavior rule emitted, which a summary row aggregates. Use it to see what actually happened behind a summary: the source events, their attributes, and their real timestamps.

rangeFrom and rangeTo are required, in epoch milliseconds. The time filter and the default sort (newest first) both run on timestamp, which — unlike a summary's bucket labels — is the true event time. Narrow with searchStr (ruleName:... or entityName:"user@example.com") or mustFilters. Use behavior_summary_search for the incident rows themselves.

Parameter	Type	Required	Description
facetSize	integer	No	Max value buckets per facet field; defaults to 20.
facets	string[]	No	Fields to count top values on across the whole match set, e.g. ['ruleName','entityName']. This is how you get a base rate without paging every document.
histogramInterval	string	No	Fixed interval for the histogram, e.g. 1h, 10m, 1d; defaults to 1h. Only used when includeHistogram is true.
includeHistogram	boolean	No	Also return a date histogram over the range (non-empty slots only); defaults to false.
limit	integer	No	Documents to return; defaults to 20. offset + limit may not exceed 10000.
mustFilters	object[]	No	Term filters every document must match; terms within one filter are OR'ed, separate filters are AND'ed.
mustFilters[].field	string	Yes	Field to filter on, e.g. ruleName, entityName or riskLevel.
mustFilters[].terms	string[]	Yes	Exact terms to match; terms within one filter are OR'ed.
mustNotFilters	object[]	No	Term filters that exclude a document when matched.
mustNotFilters[].field	string	Yes	Field to filter on, e.g. ruleName, entityName or riskLevel.
mustNotFilters[].terms	string[]	Yes	Exact terms to match; terms within one filter are OR'ed.
offset	integer	No	Documents to skip (paging); defaults to 0.
rangeFrom	integer	Yes	Start of the search window, epoch milliseconds.
rangeTo	integer	Yes	End of the search window, epoch milliseconds.
searchStr	string	No	Lucene query over the documents, e.g. entityName:"user@example.com" or ruleName:AzureAD_User_Add_Authentication_Method. Empty matches everything in the range. An email address used as a bare term must be double quoted, or the parser splits it on @ and . and matches the wrong documents.
sortField	string	No	Field to sort by. Defaults to riskScore for summaries and timestamp for events. Use to on summaries for most-recent-first.
sortOrder	string	No	Sort order: asc or desc. Defaults to desc.

eventwatch_rule_list

Effect: Read

Lists the account's eventwatch rules as a thin catalog: id, name, group, event type, and whether each rule is enabled. Use it to find the rule behind a behavior signal — a behavior summary names the rule that fired, and this maps the name to its id, group, and state.

Narrow with nameContains (case-insensitive substring), group, or enabledOnly. The reply also lists the account's distinct groups and tags; the groups values are what group accepts.

Rule definitions are not returned, because an account has hundreds of rules of several KB each. Fetch one with eventwatch_rule_get.

Parameter	Type	Required	Description
enabledOnly	boolean	No	Return only enabled rules; defaults to false (all rules).
group	string	No	Exact rule group to filter by, e.g. AD or O365; the reply's groups lists the valid values.
limit	integer	No	Maximum rules to return after filtering; defaults to 100.
nameContains	string	No	Case-insensitive substring filter on the rule name, e.g. AzureAD or Login_Failed.

eventwatch_rule_get

Effect: Read

Fetches one eventwatch rule's full definition by name, in the form eventwatch_rule_test expects. Use it to read a deployed rule's selector before changing it, and to get the rule object to test. Take the name from a behavior summary or from eventwatch_rule_list.

The reply's rule is the whole stored rule and runs to several KB. An empty name returns the account's first rule, which is useful only to see the shape.

Parameter	Type	Required	Description
name	string	Yes	Exact rule name, e.g. O365_AzureAD_UserLoggedIn. Case-sensitive. Empty returns the tenant's first rule.

eventwatch_rule_test

Effect: Read

Evaluates one eventwatch rule against one event and reports the result, without deploying anything. Use it to check a selector before shipping a rule, to show why a rule did or did not fire on a given event, and to test a tuning change against the event behind a ticket.

rule is the rule definition (from eventwatch_rule_get); event is one parsed event document — the source of a result from behavior_event_search or lake_search, passed as is. Both are JSON objects.

The reply carries hit (whether the selector matched), signals (what the rule emitted), and, for a behavior rule that hit, the rendered behaviorEvent. behaviorEvent is populated only when the rule has a behavior and it hit.

A rule with few attributes can evaluate correctly here and still be deduplicated away in production: the engine's dedup key is the rule name plus every attribute value.

Parameter	Type	Required	Description
event	object	Yes	A single parsed event document to evaluate the rule against, as a JSON object.
rule	object	Yes	The rule definition to test, as an eventwatch bucket JSON object.

investigate_sentinelone_alert

Effect: Read

Investigates one SentinelOne Unified Alert end to end in a single call: the alert, the threats correlated to it, endpoint activity around the detection, and the affected endpoint's agent record.

Identifying the alert. alertId takes either the alert's own id (a UUID) or its externalId — the numeric id a SentinelOneActivity event carries in data.alertid. The result's associations.alertMatchedField reports which one matched; when it says externalId, the alert.id in the result is the alert's own id, not the value passed in.

Integration. integrationName names a SentinelOneEvents integration (the type is SentinelOneEvents, not SentinelOne; list_integrations shows the names). When omitted, every configured SentinelOneEvents integration is tried in name order and the first that returns the alert answers. The alert is read from SentinelOne's Unified Alerts, so an account without Unified Alert Management cannot use this tool.

Reading the result. associations.confidence says how far to trust the correlated threats:

Confidence	Meaning
high	SentinelOne's own identifier links them. This holds only when the detection source is SentinelOne/EDR; for other sources externalId is that product's identifier, so correlation starts at the storyline and a warning says so.
medium	They share a storyline — the same process lineage, though a storyline can span unrelated detections.
low	They hit the same endpoint inside the detection window, which may be coincidence.
none	Nothing correlated. This is a real answer, not an error.

collectionStatus reports each section as complete, truncated, partial, failed, skipped, or unavailable, with a warnings list. A failed section does not invalidate the rest.

Activities cover a window centered on the detection time — options.activityWindowMinutes is the half-width — because mitigation and quarantine activity lands after detection. options.includeRelatedAlerts=true also pulls sibling alerts on the same storyline or endpoint; it is off by default because it is slower.

Parameter	Type	Required	Description
alertId	string	Yes	Alert to investigate: either the Unified Alert's own id (a UUID) or its externalId (the numeric id SentinelOneActivity events carry as data.alertid); both are accepted.
integrationName	string	No	Name of the SentinelOneEvents integration to query; omit to try every configured one and use the first that answers (call list_integrations to discover names).
options	object	No	Optional collection controls; every field has a sensible default.
options.activityWindowMinutes	integer	No	Half-width in minutes of the window centered on the detection time (default 60, max 10080).
options.includeActivities	boolean	No	Collect endpoint activities around the detection time (default true).
options.includeEndpoint	boolean	No	Include the endpoint/agent record for the affected asset (default true).
options.includeRelatedAlerts	boolean	No	Include other unified alerts sharing the storyline or endpoint (default false; slower).
options.includeThreats	boolean	No	Correlate SentinelOne threats to the alert (default true).
options.maxActivities	integer	No	Maximum activities to return, newest first (default 200, max 1000).

Azure & Microsoft 365

Query a customer's Azure Log Analytics workspace through an installed AzureLogAnalytics integration, and look up Azure AD users through Microsoft Graph.

Related: Office 365 ResourceWatch

azure_logs_list_tables

Effect: Read

Lists everything queryable in the Azure Log Analytics workspace — the starting point for azure_logs_search. Each entry carries name (the KQL identifier, used as is), kind, description, categories, and timespanColumn (the column Azure applies a time range to, usually TimeGenerated).

kind is table for stored data and function for a saved function or parser. On a Microsoft Sentinel workspace the ASIM parsers (_Im_NetworkSession, ASimAuthentication, ...) are functions, and are often the better thing to query.

A large workspace has hundreds of entries: filter keeps only names containing a substring (case-insensitive), such as signin or ASim. total reports the count before filtering. Columns are not included — get them with azure_logs_get_schema.

Parameter	Type	Required	Description
filter	string	No	Optional case-insensitive substring; only entries whose name contains it are returned. Use on large workspaces to avoid pulling hundreds of names.
integrationName	string	No	Name of the AzureLogAnalytics integration to query; omit when exactly one is configured.

azure_logs_get_schema

Effect: Read

Returns the column schemas of one or more Log Analytics tables or functions. tables is a list — ask for every table about to be queried in one call. Names match case-insensitively and the real name is returned. Each schema carries name, kind, description, and columns (name, type, description), with Kusto scalar types (string, long, real, bool, datetime, dynamic, guid, timespan, decimal, int).

Names the workspace does not have come back in notFound instead of failing the call.

columnSource says where the columns came from:

• metadata — a table, read from workspace metadata at no query cost, with Microsoft's column descriptions.
• probe — a saved function, which has to be executed to learn its shape: names and types, no descriptions. Probing is capped at a dozen functions per call; a function whose shape could not be resolved carries columnsError. An empty columns with no error is the only case that means the entry returns nothing.

The interior of a dynamic column is not described; project a few rows to see inside one.

Parameter	Type	Required	Description
integrationName	string	No	Name of the AzureLogAnalytics integration to query; omit when exactly one is configured.
tables	string[]	Yes	Table or function names to describe. Pass every one you are about to query in a single call; matching is case-insensitive.

azure_logs_validate

Effect: Read

Checks an Azure Log Analytics KQL query and returns ok=true, or ok=false with Azure's own parser message in error. The query is bound against the real workspace schema, so an unknown table or column is caught too.

Azure has no parse-only endpoint, so this does execute the query — against a one-second window in 1970. That scans nothing and costs essentially nothing, but it does use a workspace query slot, so it should not be called in a tight loop.

Parameter	Type	Required	Description
integrationName	string	No	Name of the AzureLogAnalytics integration to validate against; omit when exactly one is configured.
kql	string	Yes	Azure KQL query text to parse. It is bound against the real workspace schema, so an unknown table or column is caught too.

azure_logs_search

Effect: Read

Runs a KQL query against the Azure Log Analytics workspace and returns the result inline. This is native Azure KQL, forwarded verbatim — not the same dialect as kql_search, which queries the Fluency datalake. The table or function comes from the query text.

The narrower time window wins

rangeFrom and rangeTo (epoch milliseconds) are AND'ed with any time filter inside the query, and the narrower of the two wins — the opposite of kql_search, where the query's own predicates take precedence. Use one mechanism or the other, not both, or the result can come back silently empty. With neither set, the last 24 hours applies, so a query that reaches further back needs an explicit rangeFrom.

The response carries total (rows returned), took (milliseconds), timespan (the window actually used), and data — the same tables, columns, and rows envelope kql_search returns. limit caps the rows per table and sets truncated when it bites. partial=true with an error message means Azure returned real but incomplete rows (a shard failed or a limit was hit): the rows are usable, but the result is partial.

Parameter	Type	Required	Description
integrationName	string	No	Name of the AzureLogAnalytics integration to query; omit when exactly one is configured.
kql	string	Yes	Azure KQL query text. The table or function comes from the query itself. Call azure_logs_validate first.
limit	integer	No	Maximum rows to return per table (default 500, max 5000). Sets truncated=true when it bites.
rangeFrom	integer	No	Optional lower bound, epoch milliseconds. ANDed with any time filter inside the query — the narrower wins. Omit when the query constrains time itself.
rangeTo	integer	No	Optional upper bound, epoch milliseconds. Defaults to now when only rangeFrom is given; the whole window defaults to the last 24 hours when neither is given.
timeoutSeconds	integer	No	Server-side timeout in seconds (default 60, max 180). Raise only for a query you know is heavy.

get_azure_user_record

Effect: Read

Looks up an Azure AD user through Microsoft Graph by user principal name, email address, or object id, using the credentials of the account's Office365ResourceWatch integration. Returns userPrincipalName, displayName, userType (Member or Guest), email, createdDateTime, and the user's assigned Azure AD directory roles (name and description).

The user is resolved against every Office365ResourceWatch integration configured on the account; the first match wins.

Parameter	Type	Required	Description
tenant	string	No	Tenant routing identifier, used only on grid deployments. Ignored on a standard account, which always answers for itself.
username	string	Yes	User principal name, email address, or Azure AD object id (e.g. user@example.com) to resolve via Microsoft Graph.

Reports

Discover and run FPL report processors, then collect their results.

Related: Reports · Reports → Processors

list_reports

Effect: Read

Lists every FPL report processor on the platform. Each entry carries the report's name, description, scriptText (the FPL source), its arguments schema (parameter name, type, default, whether optional, enum values), and reportConfig. Use it to find which reports exist and which arguments run_report needs for each.

No parameters.

run_report

Effect: Write

Runs an FPL report processor by name.

Bind the report's declared parameters with arguments, a list of name/value pairs (the value is always a string; type defaults to string).

• Asynchronous (default). The call returns a task id immediately. Poll get_report_task until state is completed, then call get_report_result.
• Synchronous. syncMode=true blocks until the report completes and returns the full result inline. Use it only for fast reports.

fpl replaces the saved processor's script for this one run, keeping the rest of its configuration.

Parameter	Type	Required	Description
arguments	object[]	No	Argument bindings for the report's declared parameters.
arguments[].name	string	Yes	Argument name (must match a parameter declared by the report).
arguments[].type	string	No	Argument value type: string (default), integer, float, or boolean.
arguments[].value	string	Yes	Argument value, encoded as a string.
fpl	string	No	Optional FPL script text. When provided, the report runs against this script instead of the saved processor's stored ScriptText.
name	string	Yes	Saved report processor name (see list_reports).
syncMode	boolean	No	If true, block until the report completes and return the full result. If false (default), launch asynchronously and return only the taskID for status polling.

get_report_task

Effect: Read

Returns the status of a task started by run_report. state is one of registered, running, completed, aborted, or cancelled. While the task runs, recent log lines are included. Once state is completed, fetch the output with get_report_result.

Parameter	Type	Required	Description
fpl	boolean	No	If true, include the resolved FPL script text used for this task.
id	integer	Yes	Task ID returned by run_report.
limit	integer	No	Maximum number of in-progress log lines to include (default 200, only meaningful while the task is still running).

get_report_result

Effect: Read

Returns the result of a completed report task: a list of FPL objects under result.objects. Each object carries a name and exactly one payload:

• an FPL table — rowCount, columns (name, type, and unit), and rows[]; or
• an FPL stream — from, to, interval, slots[], and metrics[] time series with a value per slot.

Valid only for tasks whose state is completed.

Parameter	Type	Required	Description
id	integer	Yes	Task ID of a completed report (see get_report_task; only valid when state=completed).

Usage & metrics

Read the account's billing-usage ledger and query the platform's built-in metrics store.

Related: Platform → Usage · Metrics

usage_daily

Effect: Read

Reads the account's daily billing-usage ledger — the closed, immutable record the account measures once a day. Use it for usage totals, invoices, month-to-date figures, and usage trends. Prefer it to prom_query for anything billing-related: a PromQL query re-derives an approximation of the same numbers.

Select the range with month, with from/to, or with neither for the last 30 completed days. A month in progress ends at yesterday.

Read the flags before quoting a number:

• A meter with measured=false is unknown, not zero. A day whose state is missing had no collection at all. Neither means the account used nothing.
• summary.totals is precomputed per meter. A total with lowerBound=true is a lower bound; report it as one, with the count of unmeasured or missing days.
• storeAvailable=false means the ledger was unreachable — not that the account has no usage.
• Only days with billable=true may be used to compute a charge.

There are two datalake meters, and they legitimately differ: platform_datalake_bytes is what the datalake sink emitted; lake_ingress_bytes is what the lake ingested, including data arriving by other paths. Do not reconcile them. The ledger holds quantities only — no prices or SKUs.

Parameter	Type	Required	Description
from	string	No	Start day, YYYY-MM-DD or YYYYMMDD dayIndex (UTC). Omit with to to get the last 30 completed days.
includeOpen	boolean	No	Include today's provisional row. Its numbers are still growing and are never billable.
month	string	No	Whole month as YYYY-MM or YYYYMM (UTC), instead of from/to. A month still in progress ends at yesterday.
to	string	No	End day, inclusive, YYYY-MM-DD or YYYYMMDD dayIndex (UTC).

usage_attempts

Effect: Read

Reads the billing collection attempt ledger: every collection try, including those that failed and those that declined to run. This separates "this day genuinely has no data" from "nobody ever looked", which usage_daily alone cannot. Use it whenever a day is missing, a meter is unmeasured, or a total is a lower bound.

errorCode is the machine-readable cause, shared by every tenant-day affected by the same problem. A status of skipped with method provider_not_present means that identity provider is not integrated on the account — not a failure, and not a headcount of zero.

Parameter	Type	Required	Description
from	string	No	Start day, YYYY-MM-DD or YYYYMMDD dayIndex (UTC).
limit	integer	No	Maximum attempts to return.
month	string	No	Whole month as YYYY-MM or YYYYMM, instead of from/to.
to	string	No	End day, inclusive.

usage_sink_classification

Effect: Read

Shows how the account's datasinks are currently sorted into billing meters. processed_bytes is the one meter whose value depends on a judgement about the pipeline topology rather than on a metric label, so check this first when that number looks wrong or a sink's traffic seems to be missing.

ambiguous lists sinks whose meter differs between the platform's two execution modes. They are counted as eventwatch, which under-counts by at most that sink rather than billing it twice.

No parameters.

prom_query

Effect: Read

Runs a read-only PromQL/MetricsQL instant query against the platform's built-in VictoriaMetrics metrics store, returning the value at a single point in time. Use it for current system status and point-in-time totals; for trends, use prom_query_range.

Useful metrics:

Metric	Label	What it counts
platform_billing_bytes	meter	Billing and usage bytes
lake_ingress_count	index	Datalake ingest
platform_usage_total	type	Platform usage
platform_component_*, platform_router_*, platform_processor_*		Component runtime metrics

Example: sum(increase(platform_billing_bytes[1h])). The response carries resultType and a series list; each series has its metric label map and points (timestamp in epoch milliseconds, value).

Parameter	Type	Required	Description
query	string	Yes	PromQL or MetricsQL expression to evaluate (e.g. sum(increase(platform_billing_bytes[1h]))).
time	string	No	Evaluation instant: relative (e.g. -1h), now, epoch milliseconds, or RFC3339 (e.g. 2026-06-19T00:00:00Z); defaults to now when omitted.

prom_query_range

Effect: Read

Runs a read-only PromQL/MetricsQL range query against the built-in metrics store, returning a time series over a window. Use it for usage reports and trends.

Example: query = sum by(meter)(increase(platform_billing_bytes[1h])), from = -24h, to = now, interval = 1h. The response carries resultType=matrix and a series list; each series has its metric label map and one points entry per step (timestamp in epoch milliseconds, value).

Parameter	Type	Required	Description
from	string	Yes	Start of the window: relative (e.g. -24h), now, epoch milliseconds, or RFC3339 (e.g. 2026-06-19T00:00:00Z).
interval	string	Yes	Resolution step between data points (e.g. 1h, 5m).
query	string	Yes	PromQL or MetricsQL expression to evaluate over the window.
to	string	Yes	End of the window: relative (e.g. now), now, epoch milliseconds, or RFC3339 (e.g. 2026-06-19T00:00:00Z).

Connectors

Install, inspect, and remove connectors. A connector is an application instance installed from a template; the same objects appear on Platform → Applications.

Related: Integrations · Platform → Applications

list_connector_templates

Effect: Read

Lists every connector template (application type) the platform offers. Each entry carries the template's name, displayName, description, category, resourceGroups, and its full parameter schema (name, dataType, optional, sensitive, defaultValue, enums). Use it to find which parameters a template's create_connector call needs.

No parameters.

list_connectors

Effect: Read

Lists every installed connector instance with its application, instance id, display name, and runtime state. Use it to see what is already deployed before creating a new one.

No parameters.

get_connector

Effect: Read

Returns the state, pending actions, and output parameters of one connector instance, identified by its application and instance id.

Parameter	Type	Required	Description
application	string	Yes	Template name.
instance	string	Yes	Instance id.

create_connector

Effect: Write

Installs a new connector instance from a template. Supply the template name in application, a unique lowercase instance id in instance, and one inputParameters entry per required parameter the template declares. Get the parameter set from list_connector_templates first.

Parameter	Type	Required	Description
application	string	Yes	Template name (see list_connector_templates).
displayName	string	No	Human-readable display name.
inputParameters	object[]	No	One entry per required parameter declared by the template.
inputParameters[].name	string	Yes	Parameter name (matches a parameter declared by the template).
inputParameters[].value	string	Yes	Parameter value.
instance	string	Yes	Unique instance id (lowercase, no spaces).

delete_connector

Effect: Delete

Uninstalls a connector instance and every resource derived from it — sources, sinks, routers, pipes, and channels. This cannot be undone.

Parameter	Type	Required	Description
application	string	Yes	Template name.
instance	string	Yes	Instance id.

AWS assumed roles

Manage the AWS assumed roles AWS sources use to read from your account.

Related: Connecting to AWS · Settings → AWS Roles

get_account_podrole

Effect: Read

Returns the IAM role name and ARN of the account's pod identity (role, arn) — the trust principal an assumed role's trust policy must allow.

No parameters.

list_assumed_role

Effect: Read

Lists every assumed role configured on the platform. Each entry carries id, displayName, description, externalID, roleARN, createdOn, and the local flag.

No parameters.

get_assumed_role

Effect: Read

Returns one assumed role by id, with the same fields as list_assumed_role.

Parameter	Type	Required	Description
id	string	Yes	Assumed role id (e.g. role_xxxxxxxxxx) — call list_assumed_role to discover ids.

test_assumed_role

Effect: Read

Checks that an AWS role can actually be assumed, by calling STS GetCallerIdentity through it. Two modes:

• names — test one or more saved assumed roles by display name.
• roleARN + externalID — test a role that has not been saved yet.

Each result entry carries name, status (true when the role can be assumed), and errorMsg on failure.

Parameter	Type	Required	Description
externalID	string	No	AWS STS external id paired with roleARN.
names	string[]	No	Existing assumed-role display names to test; omit to test an ad-hoc ARN.
roleARN	string	No	Ad-hoc IAM role ARN to test without storing it; requires externalID.

add_assumed_role

Effect: Write

Creates an AWS assumed role. Supply displayName and roleARN (such as arn:aws:iam::123456789012:role/Name); externalID and description are optional. Returns the generated id (role_xxxxxxxxxx).

Parameter	Type	Required	Description
description	string	No	Optional free-text description.
displayName	string	Yes	Human-readable role name.
externalID	string	No	Optional AWS STS external id used by the assume-role policy.
roleARN	string	Yes	AWS IAM role ARN to assume (e.g. arn:aws:iam::123456789012:role/Name).

delete_assumed_role

Effect: Delete

Removes an assumed role by id. Fails with role is in use while an integration still references the role; remove or reassign those integrations first.

Parameter	Type	Required	Description
id	string	Yes	Assumed role id (e.g. role_xxxxxxxxxx) to uninstall.

Notifications & email

Manage notification endpoints and send email through the tenant's email provider.

Related: Notifications · Alerts & Actions

list_notification_endpoint

Effect: Read

Lists the notification endpoints configured on the platform. Each entry carries its name, the integration it uses, an action, and either an email block (to and cc recipients) or a slack block (integration name and channel). Use it to find endpoint names for notification rules and for send_email.

No parameters.

add_notification_endpoint

Effect: Write

Creates a notification endpoint: an endpoint with a unique name and either an email block or a slack block. Fails if an endpoint with that name exists — change an existing one with update_notification_endpoint. Returns ok=true on success.

Parameter	Type	Required	Description
endpoint	object	Yes	The notification endpoint to create.
endpoint.action	string	No	Endpoint action.
endpoint.email	object	No	Email delivery block; provide either email or slack.
endpoint.email.cc	string[]	No	Carbon-copy recipient email addresses.
endpoint.email.to	string[]	No	Recipient email addresses for this endpoint.
endpoint.integration	string	No	Integration this endpoint uses.
endpoint.name	string	Yes	Unique endpoint name (identifier).
endpoint.slack	object	No	Slack delivery block; provide either email or slack.
endpoint.slack.channel	string	No	Slack channel to post to.
endpoint.slack.integrationName	string	No	Name of the Slack integration to send through.

update_notification_endpoint

Effect: Write

Updates an existing notification endpoint, matched by name. Supply the full desired configuration — integration, action, and its email or slack block. Returns ok=true on success.

Parameter	Type	Required	Description
endpoint	object	Yes	The notification endpoint to update (matched by name).
endpoint.action	string	No	Endpoint action.
endpoint.email	object	No	Email delivery block; provide either email or slack.
endpoint.email.cc	string[]	No	Carbon-copy recipient email addresses.
endpoint.email.to	string[]	No	Recipient email addresses for this endpoint.
endpoint.integration	string	No	Integration this endpoint uses.
endpoint.name	string	Yes	Unique endpoint name (identifier).
endpoint.slack	object	No	Slack delivery block; provide either email or slack.
endpoint.slack.channel	string	No	Slack channel to post to.
endpoint.slack.integrationName	string	No	Name of the Slack integration to send through.

delete_notification_endpoint

Effect: Delete

Deletes a notification endpoint by name. Fails if no endpoint with that name exists. Returns ok=true on success.

Parameter	Type	Required	Description
name	string	Yes	Name of the notification endpoint to delete.

upload_attachment

Effect: Write

Stages a file for a later send_email call. The server downloads the file from url (http or https, public addresses only); content is limited to a few MB. filename overrides the display name taken from the URL path. Returns a token to pass in send_email's attachments.

Parameter	Type	Required	Description
filename	string	No	Filename for the attachment (basename only; used as the display name). Optional — defaults to the name derived from the URL path.
url	string	Yes	URL (http/https) of the file to attach; the server downloads it. Only public addresses are allowed.

send_email

Effect: Write

Sends an email through the tenant's configured email provider (SES or SMTP). The sender address is fixed by the tenant's email configuration; the call supplies only recipients and content.

• Recipients — to, and/or endpointName (an email notification endpoint from list_notification_endpoint), whose to and cc lists are merged with any supplied directly. At least one recipient must result. cc and bcc are optional.
• Content — a subject and at least one of bodyHTML and bodyTXT.
• Attachments — call upload_attachment for each file first and pass the returned tokens in attachments.

Returns ok=true and the sender address used.

Parameter	Type	Required	Description
attachments	object[]	No	Attachments to include; each token comes from a prior upload_attachment call.
attachments[].filename	string	No	Display filename for the attachment (defaults to the uploaded filename).
attachments[].token	string	Yes	Attachment token returned by upload_attachment.
bcc	string[]	No	Blind carbon-copy recipient email addresses.
bodyHTML	string	No	HTML body (provide bodyHTML and/or bodyTXT; at least one is required).
bodyTXT	string	No	Plain-text body (provide bodyHTML and/or bodyTXT; at least one is required).
cc	string[]	No	Carbon-copy recipient email addresses.
endpointName	string	No	Name of a predefined email notification endpoint (from list_notification_endpoint) whose recipients are used; its to/cc are merged with any to/cc you supply. At least one recipient must result, via to or this endpoint.
subject	string	Yes	Email subject line.
to	string[]	No	Recipient email addresses (required unless endpointName supplies recipients).

Syslog listeners

Read and change the platform's syslog listener configuration.

Related: Syslog Ports · Platform → Administration → Syslog Ports

syslog_get_config

Effect: Read

Returns the platform's syslog listener configuration: a config object with the domain senders should target, the allocated port range (port_begin, port_end), the four listener flags (syslog_tls, tls_rfc6587, syslog_udp, syslog_tcp), and the port each enabled listener uses (syslog_tls_port, tls_rfc6587_port, syslog_udp_port, syslog_tcp_port; 0 when that listener is disabled). config is absent when syslog has not been registered for the platform.

No parameters.

syslog_register_config

Effect: Write

Registers syslog for the platform: allocates a port range and installs the listeners requested. All four flags are required, and at least one must be true or the call is rejected. Use it only when syslog_get_config returns no config; after that, change listeners with syslog_update_config. Returns the new config, in the same shape as syslog_get_config.

Parameter	Type	Required	Description
syslog_tcp	boolean	Yes	Enable the plain TCP listener.
syslog_tls	boolean	Yes	Enable the TLS (octet-stream) listener.
syslog_udp	boolean	Yes	Enable the plain UDP listener.
tls_rfc6587	boolean	Yes	Enable the TLS RFC6587 octet-counting listener.

syslog_update_config

Effect: Write

Changes which syslog listeners are enabled. The request replaces the full set, so every call supplies all four flags — any flag set to false disables that listener. Read the current values with syslog_get_config and carry forward the ones not being changed. Requires an existing registration; ports come from the account's existing range and are not reallocated. Returns the updated config.

Parameter	Type	Required	Description
syslog_tcp	boolean	Yes	Enable the plain TCP listener; false disables it.
syslog_tls	boolean	Yes	Enable the TLS (octet-stream) listener; false disables it.
syslog_udp	boolean	Yes	Enable the plain UDP listener; false disables it.
tls_rfc6587	boolean	Yes	Enable the TLS RFC6587 octet-counting listener; false disables it.

Resource dumps

Find and download vendor resource dumps — full inventory snapshots too large to handle as a query result.

Related: SIEM → Resources

list_resource_dumps

Effect: Read

Lists the vendor resource dumps available for download, with each one's record count and uncompressed size. A dump is a full inventory snapshot of one resource type for one customer (devices, users, vulnerabilities, and so on), written as a gzipped JSONL archive with a Parquet copy beside it. formats names the formats each dump can be fetched in.

Omit resource to list every resource type, and customer to list every customer within a type. count tells you whether a dump is small enough to inspect as a query result or large enough that it should be downloaded and processed locally.

Parameter	Type	Required	Description
customer	string	No	Customer whose dumps to list; omit for every customer.
resource	string	No	Resource type to list (see list_data_tables for resource table names); omit for every resource type.

get_resource_dump_url

Effect: Read

Issues a time-limited download URL for one resource dump — the route for a dump too large to handle as a query result (a hundred thousand records is a local-processing job). Name one resource and, when that resource has dumps for several customers, one customer.

format is jsonl for the gzipped JSONL archive (the default) or parquet for the columnar copy, the better choice for pandas or DuckDB. downloadBytes is the transfer size, which for the gzipped archive is far smaller than the uncompressed size list_resource_dumps reports.

The URL carries its own credential, so curl or Python needs no other header, and it expires after 15 minutes — request a fresh one rather than storing it. An AI client hands the URL to you instead of reading the file itself. If a sandboxed client's download is refused by a proxy (a 403 or a denied CONNECT), the URL's host is not on the organization's allowed domains: add it, or download from a machine outside the sandbox.

Parameter	Type	Required	Description
customer	string	No	Customer whose dump to download; required when the resource has dumps for more than one customer.
format	string	No	File format: jsonl for the gzipped JSONL archive (default), or parquet for the columnar copy.
resource	string	Yes	Resource type to download (see list_resource_dumps).

Related

• MCP Server — connecting a client, permissions, and common call sequences
• KQL — the query language kql_search and validate_kql accept
• REST API — the HTTP interface behind the web application
• Audit — where MCP activity is recorded