get_alert_rule
Retrieve complete details of a LogicMonitor alert rule by ID to review matching conditions, escalation chain, suppression settings, and troubleshoot alert routing.
Instructions
Get detailed information about a specific alert rule by ID in LogicMonitor (LM) monitoring.
Returns: Complete alert rule details: name, priority, enabled status, detailed matching conditions (device groups, datasources, datapoints, instance filters, severity levels), escalation chain assignment, suppression windows, notification settings.
When to use:
Review exact matching logic before modifying rule
Troubleshoot why alert matched (or didn't match) this rule
Document alert routing policies
Verify suppression settings
Check which escalation chain receives matching alerts
Matching conditions explained:
deviceGroups: Which resource/device folders this rule applies to (e.g., /Production/, /Database Servers/)
datasources: Which datasources trigger this rule (e.g., CPU, Memory, AWS_EC2)
datapoints: Specific metrics (e.g., CPUBusyPercent, MemoryUsedPercent)
instances: Filter by instance name (e.g., C: drive only, eth0 interface only)
severity: Alert levels (critical, error, warn)
escalatingChainId: Where matching alerts are routed
Troubleshooting use cases:
"Why did this CPU alert go to wrong team?" → Check resource/device group + datasource filters
"Why didn't I get paged?" → Verify alert matches conditions AND check escalation chain
"Too many alerts" → Review if conditions too broad, add instance filters
Workflow: Use "list_alert_rules" to find ruleId, then use this tool to review complete matching logic and routing.
Related tools: "list_alert_rules" (find rules), "update_alert_rule" (modify), "get_escalation_chain" (check notification chain).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ruleId | Yes | The ID of the alert rule to retrieve | |
| fields | No | Comma-separated list of fields to include in response. Examples: "id,displayName,hostStatus" or use "*" for all fields. Omit this parameter to receive a curated set of commonly used fields. |