Argus Case Search Translator MCP Tools¶
These MCP tools help you build and validate Argus case search queries.
They support two main needs:
- generate a structured case search query
- discover valid values for flags, workflows, and sorting fields before building the query
General Notes¶
- Use this tool when you want the LLM to turn your case-search intent into a valid search query.
- Describe what you want to find in plain language, and the LLM can use the request fields in this document to build the search.
- If your request involves case flags, service flags, workflows, or sorting, the LLM can look up the allowed values before building the query.
- This applies to
includeCaseFlag,excludeCaseFlag,serviceFilter.includeCaseServiceFlag,serviceFilter.excludeCaseServiceFlag,sortBy, andworkflow[].flow. - The returned values are case-sensitive, so the LLM should keep them exactly as returned.
- If you want actual search results after building the query, the LLM can then use the case search execution tool with the same search intent.
Tool: generateArgusCaseSearchQuery¶
Purpose
Generate an Argus case search query from your search intent.
Arguments
Argument: request¶
High-level purpose: the full case search definition the LLM builds from your request.
- Type:
object - Required: Yes
- Default: None
request fields¶
| Field | Description | Type | Default | Required |
|---|---|---|---|---|
asset |
Match cases associated with any of the specified assets, using asset ID or short name. | array<string> |
None | No |
customer |
Match cases belonging to any of the specified customers, using customer ID or short name. | array<string> |
None | No |
caseID |
Match specific case IDs. | array<number> |
None | No |
type |
Match case types. Allowed values: securityIncident, operationalIncident, information, change. |
array<string> |
None | No |
serviceFilter |
Match case service criteria. | object |
None | No |
category |
Match case categories, using category ID or short name. | array<string> |
None | No |
currentPriority |
Match current priority values. Allowed values: low, medium, high, critical. |
array<string> |
None | No |
initialPriority |
Match initial priority values. Allowed values: low, medium, high, critical. |
array<string> |
None | No |
currentStatus |
Match current case status values. | array<string> |
None | No |
initialStatus |
Match initial case status values. | array<string> |
None | No |
timeFilter |
Time-based narrowing for case search. | object |
{ "timeField": ["all"], "startTime": "startOfDay", "endTime": "now", "timeMatchStrategy": "any" } |
No |
tag |
Tag-based case filter criteria. | array<object> |
None | No |
workflow |
Workflow-based case filter criteria. | array<object> |
None | No |
caseField |
Case field metadata filter criteria. | array<object> |
None | No |
keywordFilter |
Keyword-based search across case text fields. | object |
None | No |
userFilter |
User or user-group based case filtering. | object |
None | No |
userAssigned |
Filter specifically on whether a user is assigned. | boolean |
None | No |
techAssigned |
Filter specifically on whether technical personnel is assigned. | boolean |
None | No |
caseAccessMode |
Match case access modes. Allowed values: roleBased, readRestricted, writeRestricted, explicit. |
array<string> |
None | No |
caseExplicitAccessFilter |
Match explicit-access grant criteria. When multiple criteria are provided, all must match. | array<object> |
None | No |
includeCaseFlag |
Case flags that must all be present. When this filter is involved, the LLM can look up the allowed flag values behind the scenes. | array<string> |
None | No |
excludeCaseFlag |
Case flags that must not be present. When this filter is involved, the LLM can look up the allowed flag values behind the scenes. | array<string> |
None | No |
page |
Pagination settings. | object |
{ "limit": 25, "offset": 0 } |
No |
sortBy |
Sort order list. Use list order as priority. Prefix with - for descending. When sorting is involved, the LLM can look up the allowed sort values behind the scenes. |
array<string> |
None | No |
request.serviceFilter fields¶
| Field | Description | Type | Default | Required |
|---|---|---|---|---|
caseService |
Match cases with any of these case service IDs or short names. | array<string> |
None | No |
includeCaseServiceFlag |
Service flags that must all be present. When this filter is involved, the LLM can look up the allowed flag values behind the scenes. | array<string> |
None | No |
excludeCaseServiceFlag |
Service flags that must not be present. When this filter is involved, the LLM can look up the allowed flag values behind the scenes. | array<string> |
None | No |
request.timeFilter fields¶
| Field | Description | Type | Default | Required |
|---|---|---|---|---|
timeField |
Which case time field(s) the range applies to. Allowed values: createdTimestamp, lastUpdatedTimestamp, closedTimestamp, publishedTimestamp, customerDueTimestamp, techDueTimestamp, all. |
array<string> |
["all"] |
No |
startTime |
Start of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as startOfDay - 1 day. |
string |
startOfDay |
No |
endTime |
End of the time range. Accepts epoch millis as string, ISO-8601 UTC, or relative expressions such as now. |
string |
now |
No |
timeMatchStrategy |
How to evaluate multiple timeField values. Allowed values: any, all. |
string |
any |
No |
request.tag[] fields¶
| Field | Description | Type | Default | Required |
|---|---|---|---|---|
tagKey |
The exact tag key or name to search for. | string |
None | Yes |
value |
Tag values to match. Optional when checking only whether the tag exists. | array<string> |
None | No |
searchCondition |
How to apply this tag criterion. Allowed values: MATCH, NEGATE, EXCLUDE_TAG. |
string |
None | Yes |
request.workflow[] fields¶
| Field | Description | Type | Default | Required |
|---|---|---|---|---|
flow |
Workflow token to match. When this filter is involved, the LLM can look up the allowed workflow values behind the scenes. | string |
None | Yes |
acknowledgeStatus |
Workflow acknowledgement filter. Allowed values: acknowledged, unacknowledged, all. |
string |
all |
No |
exclude |
Negate this criterion. | boolean |
false |
No |
request.caseField[] fields¶
| Field | Description | Type | Default | Required |
|---|---|---|---|---|
fieldName |
The exact case field name to search for. | string |
None | Yes |
value |
Field values to match. Optional when checking only whether the field exists. | array<string> |
None | No |
searchCondition |
How to apply this field criterion. Allowed values: MATCH, NEGATE, EXCLUDE_FIELD. |
string |
None | Yes |
request.keywordFilter fields¶
| Field | Description | Type | Default | Required |
|---|---|---|---|---|
keywords |
Search terms to match. | array<string> |
None | No |
keywordField |
Which case text fields to search. Allowed values: subject, description, comments, customerReference, id, all. |
array<string> |
None | No |
keywordMatch |
How to evaluate multiple keywords. Allowed values: any, all. |
string |
None | No |
request.userFilter fields¶
| Field | Description | Type | Default | Required |
|---|---|---|---|---|
user |
User IDs, user names, or user-group names to match. | array<string> |
None | No |
userField |
Which user-related case fields to search. Allowed values: reporter, assignedUser, assignedTech, createdByUser, lastUpdatedByUser, closedByUser, publishedByUser, commentedByUser, watchedByUser, all. |
array<string> |
["all"] |
No |
request.caseExplicitAccessFilter[] fields¶
| Field | Description | Type | Default | Required |
|---|---|---|---|---|
startTime |
Match cases with explicit access granted after this time. Uses the same time formats as other time filters. | string |
None | No |
endTime |
Match cases with explicit access granted before this time. Uses the same time formats as other time filters. | string |
None | No |
accessLevel |
Match explicit access levels. Allowed values: read, write, owner. |
array<string> |
None | No |
user |
User IDs, user names, or user-group names whose explicit access grants should match. | array<string> |
None | No |
includeAncestor |
Whether to include the specified users and their ancestors when matching access grants. | boolean |
false |
No |
request.page fields¶
| Field | Description | Type | Default | Required |
|---|---|---|---|---|
limit |
Maximum number of items per page. Accepted range: 1 to 100. |
number |
25 |
No |
offset |
Number of items to skip before returning results. Must be 0 or greater. |
number |
0 |
No |
Usage notes
- Case search pagination supports
1to100items per page. Values outside that range will fail. - For descending sorting, the LLM can use a
-prefix such as-createdTimestamp. currentStatusandinitialStatussupport:pendingCustomer,pendingSoc,pendingVendor,workingSoc,workingCustomer,pendingClose,closed.- Tag and case-field filters support both value matching and existence checks.
Tool: listArgusCaseFlags¶
Purpose
Return the allowed case flag values for case search.
Arguments
This tool takes no arguments.
Current returned values
DELETED, EXTERNAL_SYNC, HAS_ATTACHMENT, INTERNAL, MAIL_UPDATE, MERGED, NOTIFIED, PUBLISHED, SUBMITTED_BY_ANONYMOUS_USER, SUBMITTED_BY_OTHER_USER, DEFAULT_CONTACTS, DESCRIPTION_EDITED, SUBMITTED_BY_TECH, SUBJECT_EDITED, HAS_EVENTS, TEST_DATA, HAS_COMMENTS, REOPENED, CREATED_AS_PUBLISHED
Tool: listArgusCaseSearchSortBy¶
Purpose
Return the allowed sortBy values for case search.
Arguments
This tool takes no arguments.
Current returned values
id, reporter, createdByUser, createdTimestamp, lastUpdatedByUser, lastUpdatedTimestamp, assignedUser, assignedTech, closedByUser, closedTimestamp, customerDueTimestamp, techDueTimestamp, publishedByUser, publishedTimestamp, customer, priority, status, type, service, category, subject
Tool: listArgusCaseServiceFlags¶
Purpose
Return the allowed case service flag values for service filtering within case search.
Arguments
This tool takes no arguments.
Current returned values
DELETED, HANDLED_BY_SOC, MONITORED_BY_SOC_OUTSIDE_OFFICEHOURS, DEPRECATED, EVENT_ENABLED
Tool: listArgusCaseWorkflow¶
Purpose
Return the allowed workflow values for case search.
Arguments
This tool takes no arguments.
Current returned values
validation, nocValidation, tuning, escalation, customerUpdate, escalateTI, escalateNSA, escalateLog, escalateInfra, escalateDetection, escalateOperations, escalateMSI, escalateMSIAnalyst, severityAlert, slaViolation, internalSlaViolation, delegateToSOC, escalateDEV, escalateTRS, escalateMSSAnalyst, escalateTAM, qaValidation, socAnalysis, escalateO3C