{"serverId":"mcp-registry/com.netmon/netmon-demo","tools":[{"name":"alerts_history","fixed":{"name":"alerts_history","description":"Authoritative 'what fired and when' stream — wraps the `alert_history` table (one row per incident, both legacy and modern) and `alert_outlet_log` (per-dispatch ledger keyed by history_id).\n\nDefault mode: lists incidents newest-first. Each row is one incident with opened_at / last_event_at / resolved_at framing the lifecycle, plus aggregated outlet_types[], dispatch_count, and failed_count. `status` is computed from resolved_at: 'open' if null, 'resolved' otherwise.\n\nDrill-down mode: pass `incid","inputSchema":{"type":"object","properties":{"page":{"type":"integer","minimum":1,"description":"1-indexed page number (default 1)."},"hours":{"type":"integer","maximum":168,"minimum":1,"description":"Lookback window applied against last_event_at (default 24)."},"search":{"type":"string","description":"Case-insensitive substring on alert_label / subject."},"source":{"enum":["legacy","modern","all"],"type":"string","description":"Filter by source axis. Default 'all'."},"status":{"enum":["open","resolved","all"],"type":"string","description":"Filter by lifecycle state. Default 'all'."},"end_time":{"type":"string","description":"ISO-8601 UTC; pairs with start_time."},"per_page":{"type":"integer","maximum":200,"minimum":1,"description":"Rows per page (default 50, max 200)."},"severity":{"description":"Severity int or array of ints (1-5, lower=worse).","type":"string"},"device_id":{"type":"integer","description":"Restrict to one device id."},"start_time":{"type":"string","description":"ISO-8601 UTC; pairs with end_time."},"incident_id":{"type":"integer","description":"If set, switches to per-incident dispatch-ledger mode (returns alert_outlet_log rows). This is alert_history.id, NOT alert_id."}}},"annotations":{"title":"Alert Incident History","readOnlyHint":true,"openWorldHint":false,"idempotentHint":true,"destructiveHint":false}},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: severity. Change to number/boolean/array where that's what you accept.","verify":true}],"tokensBefore":484,"tokensAfter":489},{"name":"alerts_list","fixed":{"name":"alerts_list","description":"List configured alert definitions across both axes of the rule engine. Modern alerts (table `alerts`, class-scoped: syslog_log / event_log / eve_log / device_down / storage) and legacy alerts (per-device tracker thresholds, surfaced via the `_hell` view) are fetched, normalized, merged, filtered, and paginated.\n\nWraps GET /api/alerts (modern) and POST /api/getAlerts (legacy). Both endpoints return their full catalog; this tool applies the filters and pagination client-side, so the LLM doesn't ne","inputSchema":{"type":"object","properties":{"page":{"type":"integer","minimum":1,"description":"1-indexed page number (default 1)."},"class":{"enum":["syslog_log","event_log","eve_log","device_down","storage"],"type":"string","description":"Modern-only filter on the alert class (silently ignored on legacy rows)."},"scope":{"enum":["modern","legacy","all"],"type":"string","description":"Which axis to query: 'modern' (alerts table), 'legacy' (_hell view), or 'all' (default)."},"search":{"type":"string","description":"Case-insensitive substring match on label."},"enabled":{"type":"boolean","description":"Restrict to enabled (true) or disabled (false) alerts."},"per_page":{"type":"integer","maximum":200,"minimum":1,"description":"Rows per page (default 50, max 200)."},"severity":{"description":"Severity int or array of ints. Modern uses 1-5 (lower=worse). Legacy varies by tracker type; passing an int filters both axes.","type":"string"},"device_id":{"type":"integer","description":"Legacy-only: restrict to a single device id. Ignored on modern rows."}}},"annotations":{"title":"List Alert Definitions","readOnlyHint":true,"openWorldHint":false,"idempotentHint":true,"destructiveHint":false}},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: severity. Change to number/boolean/array where that's what you accept.","verify":true}],"tokensBefore":442,"tokensAfter":447},{"name":"eve_search","fixed":{"name":"eve_search","description":"Search Suricata EVE-format IDS events. Wraps GET /api/eve/list (permission: logs); tag-scoped server-side.\n\nSeverity is Suricata-native: 1=high, 2=medium, 3=low/info — a 3-point scale, NOT syslog's 0-7. Takes names or ints: 'high'=1, 'medium'=2, 'low'/'info'/'informational'=3. Single value or an array, which may mix the two forms (e.g. [\"high\", 2]).\n\nIP filters: passing only src_ip or only dst_ip matches either side (OR); pass both to AND them together. `device_id` is a convenience — the control","inputSchema":{"type":"object","properties":{"vlan":{"type":"integer"},"hours":{"type":"integer","maximum":168,"minimum":1,"description":"Lookback hours (1-168). Default 24."},"iface":{"type":"string","description":"Capture interface."},"limit":{"type":"integer","maximum":500,"minimum":1},"proto":{"type":"string","description":"Protocol name (e.g. 'TCP', 'UDP')."},"dst_ip":{"type":"string","description":"Destination IP. Matches either side when src_ip is absent."},"src_ip":{"type":"string","description":"Source IP. Matches either side when dst_ip is absent."},"dst_port":{"type":"integer"},"end_time":{"type":"string","description":"ISO-8601 UTC; must pair with start_time."},"severity":{"description":"Severity name(s) or int(s) on Suricata's 3-point scale: 'high'=1, 'medium'=2, 'low'/'info'/'informational'=3. Single value or array; names and ints may be mixed.","type":"string"},"src_port":{"type":"integer"},"device_id":{"type":"integer","description":"Restrict to a single device id (translated to src_ip/dst_ip server-side)."},"start_time":{"type":"string","description":"ISO-8601 UTC; must pair with end_time."},"signature_id":{"description":"Suricata signature id(s). Single int or array.","type":"string"}}},"annotations":{"title":"Search Suricata IDS Events","readOnlyHint":true,"openWorldHint":false,"idempotentHint":true,"destructiveHint":false}},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: severity, signature_id. Change to number/boolean/array where that's what you accept.","verify":true}],"tokensBefore":483,"tokensAfter":492},{"name":"eventlog_search","fixed":{"name":"eventlog_search","description":"Search Windows Event Log entries ingested from Netmon agents. Wraps GET /api/eventlog/list (permission: logs); tag-scoped server-side.\n\nSeverity is the raw Windows EventRecord.Level: 'logalways'=0 (what Security-channel audit events carry), 'critical'=1, 'error'=2, 'warning'=3, 'information'=4, 'verbose'=5 — pass names or ints. Note 0 is NOT Information.\n\nWindow: `hours` (1-168, default 24) OR `start_time`+`end_time`. `limit` defaults to 50 (max 500). `total` in the response is the full match co","inputSchema":{"type":"object","properties":{"log":{"type":"string","description":"Event log channel name (e.g. 'Application', 'System', 'Security')."},"hours":{"type":"integer","maximum":168,"minimum":1,"description":"Lookback window in hours (1-168). Default 24."},"limit":{"type":"integer","maximum":500,"minimum":1,"description":"Max rows returned (1-500). Default 50."},"source":{"type":"string","description":"Event source name."},"message":{"type":"string","description":"Substring match against the event data field."},"end_time":{"type":"string","description":"ISO-8601 UTC; must pair with start_time."},"event_id":{"description":"Windows Event ID(s). Single int or array.","type":"string"},"severity":{"description":"Severity name(s) or int(s). See tool description for the Windows-specific scheme.","type":"string"},"device_id":{"type":"integer","description":"Restrict to a single device id."},"start_time":{"type":"string","description":"ISO-8601 UTC; must pair with end_time."}}},"annotations":{"title":"Search Windows Event Log","readOnlyHint":true,"openWorldHint":false,"idempotentHint":true,"destructiveHint":false}},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: event_id, severity. Change to number/boolean/array where that's what you accept.","verify":true}],"tokensBefore":420,"tokensAfter":429},{"name":"syslog_search","fixed":{"name":"syslog_search","description":"Search syslog messages from network devices. Wraps GET /api/syslog/list (permission: logs); tag-scoped server-side.\n\nFilters (all optional): device_id, severity (name or int 0-7), facility (int 0-23), source (exact host/IP), message (substring).\n\nWindow: `hours` (1-168, default 24) OR `start_time`+`end_time` (ISO-8601 UTC). `limit` defaults to 50 (max 500). The response's `total` is the full match count — if it exceeds `limit`, narrow the window or add severity/message filters rather than bumpin","inputSchema":{"type":"object","properties":{"hours":{"type":"integer","maximum":168,"minimum":1,"description":"Lookback window in hours (1-168). Default 24."},"limit":{"type":"integer","maximum":500,"minimum":1,"description":"Max rows returned (1-500). Default 50."},"source":{"type":"string","description":"Source host/IP string match (exact)."},"message":{"type":"string","description":"Substring match against message text (case-insensitive)."},"end_time":{"type":"string","description":"ISO-8601 UTC. Must be paired with start_time."},"facility":{"description":"Syslog facility int(s) 0-23. Accepts single or array.","type":"string"},"severity":{"description":"One severity or an array. Strings (e.g. 'error') or ints 0-7.","type":"string"},"device_id":{"type":"integer","description":"Restrict to a single device id."},"start_time":{"type":"string","description":"ISO-8601 UTC (e.g. 2026-04-23T10:00:00Z). Must be paired with end_time."}}},"annotations":{"title":"Search Syslog","readOnlyHint":true,"openWorldHint":false,"idempotentHint":true,"destructiveHint":false}},"changes":[{"kind":"schema","detail":"Added \"type\":\"string\" to untyped parameters: facility, severity. Change to number/boolean/array where that's what you accept.","verify":true}],"tokensBefore":406,"tokensAfter":415}],"toolsChanged":5,"tokensSaved":0,"todo":[{"tool":"eve_search","params":["vlan","limit","dst_port","src_port"]},{"tool":"netflow_raw_search","params":["vlan"]}],"note":"Deterministic fixes. Changes marked verify need a human look before shipping (renames, inferred annotations, inferred types, removed text). Parameter descriptions in `todo` need to be written by someone who knows the API."}