Logicmonitor

Classify metric trends as stable, increasing, decreasing, cyclic, or volatile. Uses linear regression slope, coefficient of variation, and autocorrelation.

Clear all session context (last results, variables, and history)

Trigger an on-demand config collection for a device instance

Compare current metrics against a stored baseline. Reports deviation percentage and status (normal, elevated, reduced, anomalous) per datapoint.

Correlate alerts by device, datasource, and temporal proximity. Groups alerts into clusters to identify related issues.

Cross-reference alert spikes with audit/change logs. Identifies changes that may have triggered alert increases using configurable correlation windows.

Compute Pearson correlation between multiple metric series. Builds an NxN correlation matrix and highlights strong correlations (|r| > 0.7). Maximum 10 sources.

Create an action chain from ordered diagnostic/remediation stages (requires write permission). Each stage references a DiagnosticSource or RemediationSource by ID.

Create an action rule binding an action chain to alert conditions (requires write permission)

Create an alert rule in LogicMonitor (requires write permission)

Create a collector group (requires write permission)

Create a ConfigSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_configsource output). For LM Exchange format, use import_configsource.

Create a dashboard, optionally from template (requires write permission)

Create a dashboard group in LogicMonitor (requires write permission)

Create a DataSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_datasource output). Use for round-tripping exports or building definitions from scratch. For LM Exchange format, use import_datasource. Script DataSource datapoints require appropriate type values.

Create a new device/resource (requires write permission)

Create a new device/resource group (requires write permission)

Create a DiagnosticSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_diagnosticsource output). For LM Exchange format, use import_diagnosticsource.

Create an escalation chain (requires write permission)

Create an EventSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_eventsource output). For LM Exchange format, use import_eventsource.

Create a Custom HTTP Delivery integration (type=http). Required fields: name, url. Use extra_fields for OAuth, actionNotes*, updateData*, or the 'extra' UI metadata blob. (requires write permission)

Create a LogSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_logsource output). For LM Exchange format, use import_logsource.

Create a PropertySource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_propertysource output). Use for round-tripping exports or building definitions from scratch. For LM Exchange format, use import_propertysource.

Create a recipient group (requires write permission)

Create a RemediationSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_remediationsource output). RemediationSources have no LM Exchange import endpoint.

Create a new report (requires write permission)

Create a scheduled downtime (requires write permission) Common mistakes: duration_minutes is MINUTES not hours/seconds. DeviceSDT needs device_id, DeviceGroupSDT needs device_group_id. DeviceDataSourceSDT needs device_id + datasource_id. Cloud resources (collector_id=-2) may not support DeviceSDT; use DeviceGroupSDT on their parent group instead.

Create a TopologySource via REST API from a full definition dict (requires write permission). Accepts REST API format. For LM Exchange format, use import_topologysource.

Create a user in LogicMonitor (requires write permission)

Create a website check in LogicMonitor (requires write permission)

Create a website group in LogicMonitor (requires write permission)

Show which customer portal is currently active.

Delete an action chain (requires write permission). Action rules referencing it stop triggering.

Delete an action rule (requires write permission)

Delete an alert rule from LogicMonitor (requires write permission)

Delete a collector (requires write permission). Blocks if devices are still assigned.

Delete a collector group (requires write permission). Blocks if collectors are still assigned.

Delete a ConfigSource definition (requires write permission). Existing collected data is retained.

Delete a dashboard (requires write permission)

Delete a dashboard group from LogicMonitor (requires write permission)

Delete a DataSource definition (requires write permission). Existing collected data is retained.

Delete a device/resource (requires write permission). Soft delete by default.

Delete a device/resource group (requires write permission). Shows impact.

Delete a monitored instance from a datasource on a device (requires write permission)

Delete a DiagnosticSource definition (requires write permission). Action chains referencing it lose that stage.

Delete an escalation chain (requires write permission)

Delete an EventSource definition (requires write permission). Existing collected data is retained.

Delete an integration by ID. Works for any integration type (http, slack-2, pagerduty, etc.). (requires write permission)

Delete a LogSource definition (requires write permission). Existing collected data is retained.

Delete an ops note (requires write permission)

Delete a PropertySource definition (requires write permission). Existing collected data is retained.

Delete a recipient group (requires write permission)

Delete a RemediationSource definition (requires write permission). Action chains referencing it lose that stage.

Delete a report (requires write permission)

Delete a scheduled downtime (requires write permission)

Delete a user-defined session variable

Delete a TopologySource definition (requires write permission). Existing collected data is retained.

Delete a user from LogicMonitor (requires write permission)

Delete a website check from LogicMonitor (requires write permission)

Delete a website group from LogicMonitor (requires write permission)

Delete a widget from a dashboard (requires write permission)

Sliding-window detector for mass alert events: N alerts from the same DataSource across M+ devices within T seconds. Answers 'did a bunch of stuff break at once?' Used for detecting cascading failures like mass interface-down events during a site outage.

Detect regime shifts in metric data using the CUSUM algorithm. Identifies points where the mean value changes significantly.

Detect periodic patterns in metric data using autocorrelation. Identifies dominant periods (1h, 4h, 12h, 24h, 168h) and peak activity hours.

Composite workflow for site outage detection. Chains CollectorDown detection, mass-interface-down burst analysis, UPS on-battery events, and downstream device silence into a single site-outage verdict with confidence score, scope, and affected device list. Designed to catch the class of site-outage that generic AIOps correlation misses. Pass a device group ID representing the site.

Composite diagnosis: given an alert or device, gathers alert details, device context, correlated alerts, recent changes, blast radius, and health score. Returns a diagnosis report with probable root cause and recommendations.

Execute a DiagnosticSource script on a target device. Performs pre-execution checks (collector version, device status, script review) before triggering manual execution. Poll get_diagnostic_remediation_results for status and output. Requires write permission.

Execute a RemediationSource script on a target device. Performs pre-execution checks (collector version, device status, script review) before triggering manual execution. Requires write permission.

Export an alert rule definition

Export a ConfigSource definition (REST API format). Output can be used with create_configsource or update_configsource.

Export a dashboard definition

Export a datasource definition (REST API format). Output can be used with create_datasource or update_datasource.

Export a DiagnosticSource definition (REST API format). Output can be used with create_diagnosticsource or update_diagnosticsource.

Export an escalation chain definition

Export an EventSource definition (REST API format). Output can be used with create_eventsource or update_eventsource.

Export a LogSource definition (REST API format). Output can be used with create_logsource or update_logsource.

Export a PropertySource definition (REST API format). Output can be used with create_propertysource or update_propertysource.

Export a RemediationSource definition (REST API format). Output can be used with create_remediationsource or update_remediationsource.

Forecast when a metric will breach a threshold using linear regression. Analyzes historical data to predict trend direction and estimated breach time.

Get details about a specific access group

List access groups

Get details about a specific action chain including its stages

List action chains: ordered DiagnosticSource/RemediationSource stages that action rules trigger on alerts (Automated Diagnostics & Remediation)

Get details about a specific action rule

List action rules: alert conditions (severity, device groups, datasource matchers) that trigger action chains

Get currently active SDTs

Get detailed information about a specific alert

Get details about a specific alert rule

List alert rules

Aggregate alert counts by severity, device, datasource, and time bucket. Returns statistical summary over a time window.

Get alerts from LogicMonitor with optional filtering For Kubernetes clusters, use group_id (from get_device_groups) instead of device — the device name filter does not work reliably for K8s resources. Common mistakes: startEpoch/endEpoch use SECONDS not milliseconds. String filter values need double quotes (e.g., monitorObjectName:"hostname").

Get details about a specific API token

Get API token usage audit logs

List API tokens

Get audit logs from LogicMonitor

Get details about a specific batch job

List batch jobs

Get configuration change audit logs

Get detailed information about a specific collector

Get details about a specific collector group

List collector groups

Enriched collector status with time-since-last-contact, downstream device count, dependent alert count, and optional CollectorDown history. Leading indicator for site-level events. Prefer this over `get_collectors` when investigating potential outages.

List collectors from LogicMonitor

Get details about a specific ConfigSource

Get update history and audit trail for a ConfigSource

List ConfigSources

Get a specific cost recommendation by ID (v224 API)

Get cost recommendation categories with counts and savings

Get cost optimization recommendations. Category filter takes the category description string from get_cost_recommendation_categories

List credentials from Ansible Automation Platform (secrets not exposed)

Get detailed information about a specific dashboard

Get details about a specific dashboard group

List dashboard groups

Get widgets configured on a dashboard

List dashboards from LogicMonitor

Get details about a specific datasource

List datasources from LogicMonitor

Get detailed information about a specific device (resource)

List BatchJob datasources applied to a device (resource); per-run output lives in instance data via get_device_data

List config versions collected for a device instance

Get a specific config version with full content and diffs

Get device/resource relationships and connections

Get metric data for a device/resource datasource instance Common mistakes: Returns most recent data unless period/start/end specified. Requires device_datasource_id (from get_device_datasources) not the datasource definition ID.

Get datasources applied to a device (resource) Common mistakes: Returns device-datasource associations not definitions. The ID returned here is device_datasource_id for use with get_device_data.

Get EventSources applied to a device (resource). Returns device-level EventSource associations.

Get detailed information about a specific device/resource group, including appliesTo expression and parent ID

List device/resource groups from LogicMonitor

Get instances of a datasource on a device (resource)

Get network interfaces for a device (resource)

Get LogSources applied to a device (resource)

Get neighboring devices/resources based on topology

Get all properties of a device (resource)

Get a specific property of a device (resource)

List devices (resources) from LogicMonitor with optional filtering

List the diagnostic and remediation sources assigned to a specific resource or alert (Automated Diagnostics & Remediation). Unlike get_diagnosticsources/get_remediationsources, this resolves which modules actually apply to the target.

Get structured execution results for diagnostic and remediation source runs: status, trigger type, executor, script output, and timing. Provide exactly one of alert_id or host_id. Time window params are epoch milliseconds; result timestamps are epoch seconds.

Get details about a specific DiagnosticSource including datapoints

List DiagnosticSources from LogicMonitor

Get details about a specific escalation chain

List escalation chains

Get details about a specific EventSource

List EventSources

Get graph image data for visualization

List hosts from Ansible Automation Platform

Get idle/underutilized cloud resources (resolved from idle-type cost recommendation categories)

Get a specific integration's full definition. Field set depends on integration type; password/OAuth secret fields are masked.

List LogicMonitor integrations (Custom HTTP Delivery, Slack, PagerDuty, etc.). Returns a short summary per integration.

Pull interface-level metrics (in/out bytes, errors, discards, utilization, status) for a device's interface over a time window. Answers 'how is this port performing?' Resolves the Interface-family DataSource and the instance matching the interface name before fetching datapoints.

List inventories from Ansible Automation Platform

List hosts in a specific inventory

Get events from a specific job run

Get the stdout output of a job

Get the status of a running or completed job

Get details of a specific job template

List job templates from Ansible Automation Platform

Identify interfaces with repeated up/down transitions in a time window. Answers 'which ports are unstable?' Common causes: bad cable, duplex mismatch, bad SFP, PoE power cycling, WAN instability.

Get login/authentication audit logs

Get details about a specific LogSource

List LogSources

Detect metric anomalies using z-score analysis. Identifies data points deviating significantly from the mean.

Get details about a specific network scan

List network scans

Get network flow data (NetFlow/sFlow)

Get details about a specific OID

List OID definitions

Get details about a specific ops note

List ops notes

List organizations from Ansible Automation Platform

[PREVIEW] List values observed for one native OTLP metric label (e.g. all service_name values)

[PREVIEW] List label names on native OTLP metrics, optionally narrowed to one metric

[PREVIEW] List metric names ingested via native OpenTelemetry (OTLP). Requires the OTLP Metrics feature flag; returns a friendly notice when unavailable

Filter alerts for UPS/PDU power-event signatures across APC, Liebert, and Eaton DataSources ('on battery', 'runtime remaining', 'input voltage lost') over a time window. Returns events matched by DataSource or alert name substring with counts per pattern.

List projects from Ansible Automation Platform

Get details about a specific PropertySource

List PropertySources

Get details about a specific recipient group

List recipient groups

Get LogicMonitor reference content (schemas, enums, filter syntax, guides). Mirrors content from MCP Resources for clients without full Resource support (Copilot cloud agent, OpenAI Codex, Cline). Categories: schema, enums, filters, syntax, guide. Pass list=true (or omit both category and name) to discover all available (category, name) pairs.

Get details about a specific RemediationSource including the Groovy script

List RemediationSources from LogicMonitor

Get detailed information about a specific report

Poll the status of a report generation task started by run_report (returns status and result URL when finished)

List report groups

List reports from LogicMonitor

Get details about a specific role

List roles

Get batch jobs related to SDT automation

Get reports with schedules configured

Get details about a specific Service Insight service

List Service Insight service groups (BizService device groups)

List Service Insight business services (deviceType 6 devices, including APM trace services)

Get current session context (last results, variables, history)

Get a user-defined session variable

Rank NetFlow flows on an exporter by bandwidth, packets, or flow count. Group by source IP, destination IP, protocol, application, or source->destination pair. Answers 'what is consuming my WAN?'

Get network topology map data

Get details about a specific TopologySource

List TopologySources

Get per-operation RED metrics (Duration, ErrorOperationCount, OperationCount)

List operations (endpoints/routes) for an APM service datasource

Get detailed information about a specific APM trace service

Get alerts for an APM trace service

List datasources applied to an APM service (e.g. LogicMonitor_APM_Services, _Operations)

Get APM service-level RED metrics (Duration, ErrorOperationCount, OperationCount)

Get properties for an APM service (OTel attributes, namespace, metadata)

List APM trace services (deviceType:6). Entry point for discovering traced services.

Get SDTs scheduled to start within a time window

Get details about a specific user

List users from LogicMonitor

Get detailed information about a specific website

Get synthetic check data for a website

List website groups

List websites from LogicMonitor

Get details about a specific widget

Get LogicMonitor workflow guidance text (incident_triage, rca_workflow, remediate_workflow, etc.). Mirrors MCP Prompt content for clients without Prompt support. Prefer the composite workflow tools (triage, diagnose, health_check, capacity_plan, portal_overview) when they exist -- those execute the procedure. Pass list=true to discover available workflows.

Get the status of a workflow job

List workflow job templates from Ansible Automation Platform

Composite health check: resolves a device, scores health across datasources, detects anomalies, checks alerts, and calculates availability. Returns a single device health report.

Import an AppliesTo function from JSON (requires write permission)

Import a ConfigSource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions (e.g., from export_configsource), use create_configsource instead.

Import a DataSource from LM Exchange JSON format via multipart upload (requires write permission). This expects LM Exchange format, not REST API format. For REST API format definitions (e.g., from export_datasource), use create_datasource instead.

Import a DiagnosticSource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions (e.g., from export_diagnosticsource), use create_diagnosticsource instead.

Import an EventSource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions (e.g., from export_eventsource), use create_eventsource instead.

Import a JobMonitor from JSON (requires write permission)

Import a LogSource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions (e.g., from export_logsource), use create_logsource instead.

Import a PropertySource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions (e.g., from export_propertysource), use create_propertysource instead.

Import a TopologySource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions, use create_topologysource instead.

Ingest log entries into LogicMonitor (requires LMv1 auth)

Launch an Ansible job template. Requires write permission.

Launch a workflow job template. Requires write permission.

List the customer portals available in this multi-portal server.

List scheduled downtimes from LogicMonitor

List recent tool call history

Composite portal overview: aggregates alert statistics, collector health, maintenance windows, noise scores, and dead devices into a shift-handoff report.

Push custom metrics into LogicMonitor (requires LMv1 auth)

[PREVIEW] Run a PromQL range query against native OTLP metrics. Returns a time-series matrix

Recover a soft-deleted device/resource (requires write permission). Only works within the recovery window.

Relaunch a previously run job. Requires write permission.

Re-read the vault so portals added or removed since startup take effect without restarting the client.

Execute a network scan (requires write permission)

Run/execute a report (requires write permission)

Save a metric baseline from historical data. Computes mean, min, max, stddev per datapoint and stores as a session variable for later comparison.

Score alert noise level using Shannon entropy and flap detection. Produces a score from 0 (quiet) to 100 (extremely noisy) with recommendations for tuning. Reads the window's cleared and active alerts, so a cleared alert that re-fires counts as a flap; truncated says when the 5000-alert cap cut either read short.

Score health of a specific device-datasource instance using z-score analysis. For full device health reports across all datasources, use the health_check composite tool instead.

Search available MCP tools by keyword or category. Use this to discover which tools are available for a task.

Enable or disable an action rule without touching its matchers (requires write permission)

Set a user-defined session variable for use across tool calls

Apply Terraform configuration changes. Creates, updates, or destroys infrastructure as defined in the configuration. Triple-gated: requires LM_ENABLE_WRITE_OPERATIONS=true, TF_AUTO_APPROVE_ENABLED=true, and confirm=true parameter.

Destroy all Terraform-managed infrastructure in a workspace. Triple-gated: requires LM_ENABLE_WRITE_OPERATIONS=true, TF_AUTO_APPROVE_ENABLED=true, and confirm=true parameter.

Export an existing LogicMonitor resource as Terraform HCL configuration using the logicmonitor/logicmonitor provider. Supports device, device_group, collector, alert_rule, escalation_chain, dashboard, datasource, sdt, website, role, and report_group resource types.

Import an existing resource into Terraform state. Maps a real-world resource (by ID) to a Terraform resource address for state tracking.

Initialize a Terraform workspace and download required providers. Run this before plan, apply, or any other terraform operation. Requires LM_ENABLE_WRITE_OPERATIONS=true.

Show Terraform output values defined in the configuration.

Preview Terraform changes without applying. Shows what resources will be created, modified, or destroyed. Returns structured JSON plan. Requires LM_ENABLE_WRITE_OPERATIONS=true, since providers and data sources run against live APIs.

List all resources currently tracked in Terraform state for a workspace.

Show detailed Terraform state for a specific resource, including all attributes and metadata.

Validate Terraform configuration syntax in a workspace. Returns validation diagnostics as structured JSON.

Write HCL configuration content to a file in a Terraform workspace. Use this to create or update .tf files that define infrastructure.

Test connectivity to Ansible Automation Platform controller

Composite triage: correlates alerts, clusters by device/time, scores noise, assesses blast radius, and checks recent changes. Returns a prioritized incident report.

Update an action chain via PATCH; only provided fields are sent (requires write permission)

Update an action rule via PATCH; only provided fields are sent (requires write permission)

Update an alert rule in LogicMonitor (requires write permission)

Update a collector (requires write permission). Change group, description, failback, or escalation chain.

Update a collector group (requires write permission)

RAW UPDATE -- full-replace semantics. Any field omitted from `definition` is BLANKED on the server. PREFER update_logicmodule(type='configsource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Update an existing dashboard (requires write permission)

Update a dashboard group (requires write permission)

RAW UPDATE -- full-replace semantics. Any field omitted from `definition` is BLANKED on the server. Two prior production incidents wiped Groovy scripts via this tool. PREFER update_logicmodule(type='datasource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Update an existing device/resource (requires write permission). Custom properties are merged with existing properties (not replaced).

Update a device-level EventSource association (requires write permission). Use to enable or disable alerting for an EventSource on a specific device.

Update a device/resource group (requires write permission). Custom properties are merged with existing.

Update a monitored instance on a device (requires write permission)

Update or create a device/resource property (requires write permission)

RAW UPDATE -- full-replace semantics. Any field omitted from `definition` is BLANKED on the server, including the script. PREFER update_logicmodule(type='diagnosticsource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Update an escalation chain (requires write permission)

RAW UPDATE -- full-replace semantics. Any field omitted from `definition` is BLANKED on the server. PREFER update_logicmodule(type='eventsource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Update a Custom HTTP Delivery integration via PATCH. Only fields explicitly provided are sent; omitted fields keep their current server values. (requires write permission)

Safe partial update for LogicMonitor source types (configsource, datasource, eventsource, logsource, propertysource, topologysource). Exports the current full definition, deep-merges your `changes` onto it, validates required fields, and either returns a dry-run diff (mode='preview', default) or applies the merged definition (mode='apply'). PREFER this over the raw update_<type> tools for partial updates -- the raw tools are full-replace and will blank any field omitted from the payload (two prior production incidents).

RAW UPDATE -- full-replace semantics. Any field omitted from `definition` is BLANKED on the server. PREFER update_logicmodule(type='logsource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Update an ops note (requires write permission)

RAW UPDATE -- full-replace semantics. Any field omitted from `definition` is BLANKED on the server. PREFER update_logicmodule(type='propertysource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Update a recipient group (requires write permission)

RAW UPDATE -- full-replace semantics. Any field omitted from `definition` is BLANKED on the server, including the script. PREFER update_logicmodule(type='remediationsource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Update a report's schedule (requires write permission)

Update a scheduled downtime (requires write permission). Uses fetch-modify-PUT to preserve unmodified fields.

RAW UPDATE -- full-replace semantics. Any field omitted from `definition` is BLANKED on the server. PREFER update_logicmodule(type='topologysource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Update a user in LogicMonitor (requires write permission)

Update a website check in LogicMonitor (requires write permission)

Update a widget (requires write permission)

Switch the active customer portal for subsequent tool calls.

Generate a plain-English summary of structured data using IBM Granite LLM via watsonx.ai. Takes JSON output from any tool and produces a concise, shift-handoff-ready analysis summary.