query_logs
Query logs, or aggregate them: rows plus a reusable pagination handle, or groupby / sampleby / countonly (see below)
How to use it
query_logs is exposed by the Fortianalyzer MCP MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the query_logs tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Fortianalyzer MCP
pip install -e .Other tools in Fortianalyzer MCP (39)
Add a new device to FortiAnalyzer
Add multiple devices at once
Release a pagination handle
Remove a device from FortiAnalyzer
Remove multiple devices at once
Fetch FortiView query results
Fetch another page for a querylogs handle (re-runs the query at a new offset)
Check report generation status
Get specific ADOM details
Get security alerts
Get API rate limiting configuration (FAZ 7.6.5+)
Get specific device information
Get detailed device information
Run FortiView and get results (auto-wait)
Get High Availability cluster status
Get available log fields for a log type
Check log search progress
Get log statistics
Get log file state information
Download PCAP file for an IPS event
Download completed report data
Get report generation history
List currently running reports
Get FortiAnalyzer system status and version info
Get task details by ID
List all Administrative Domains
List device groups in an ADOM
List VDOMs for a device
List devices in an ADOM
List available report layouts
List available report templates
List background tasks
Run report and wait for completion
Start a FortiView analytics query
Start a report generation
Download and save report to disk
Search devices with filters
Update API rate limits (FAZ 7.6.5+)
Wait for a task to complete