List devices (resources) from LogicMonitor with optional filtering

Get detailed information about a specific device (resource)

List device/resource groups from LogicMonitor

Get detailed information about a specific device/resource group, including appliesTo expression and parent ID

Create a new device/resource (requires write permission)

Update an existing device/resource (requires write permission). Custom properties are merged with existing properties (not replaced).

Delete a device/resource (requires write permission). Soft delete by default.

Recover a soft-deleted device/resource (requires write permission). Only works within the recovery window.

Delete multiple devices/resources in one operation (max 100, requires write permission). Soft delete by default.

Create a new device/resource group (requires write permission)

Update a device/resource group (requires write permission). Custom properties are merged with existing.

Delete a device/resource group (requires write permission). Shows impact.

Get alerts from LogicMonitor with optional filtering

For Kubernetes clusters, use group_id (from get_device_groups) instead of device — the device name filter does not work reliably for K8s resources.

Common mistakes: startEpoch/endEpoch use SECONDS not milliseconds. String filter values need double quotes (e.g., monitorObjectName:"hostname").

Get detailed information about a specific alert

Acknowledge an alert (requires write permission)

Common mistakes: alert_id works with or without the LMA prefix.

Add a note to an alert without acknowledging (requires write permission)

Acknowledge multiple alerts at once (max 100, requires write permission)

List scheduled downtimes from LogicMonitor

Create a scheduled downtime (requires write permission)

Common mistakes: duration_minutes is MINUTES not hours/seconds. DeviceSDT needs device_id, DeviceGroupSDT needs device_group_id. DeviceDataSourceSDT needs device_id + datasource_id. Cloud resources (collector_id=-2) may not support DeviceSDT; use DeviceGroupSDT on their parent group instead.

Delete a scheduled downtime (requires write permission)

Update a scheduled downtime (requires write permission). Uses fetch-modify-PUT to preserve unmodified fields.

Create SDT for multiple devices/resources (max 100, requires write permission)

Delete multiple SDTs at once (max 100, requires write permission)

Get currently active SDTs

Get SDTs scheduled to start within a time window

List collectors from LogicMonitor

Get detailed information about a specific collector

List collector groups

Get details about a specific collector group

Update a collector (requires write permission). Change group, description, failback, or escalation chain.

Delete a collector (requires write permission). Blocks if devices are still assigned.

Create a collector group (requires write permission)

Update a collector group (requires write permission)

Delete a collector group (requires write permission). Blocks if collectors are still assigned.

Get datasources applied to a device (resource)

Common mistakes: Returns device-datasource associations not definitions. The ID returned here is device_datasource_id for use with get_device_data.

Get instances of a datasource on a device (resource)

Add a monitored instance to a datasource on a device (requires write permission). Used for datasources without Active Discovery (e.g. ServiceStatus).

Update a monitored instance on a device (requires write permission)

Delete a monitored instance from a datasource on a device (requires write permission)

Get metric data for a device/resource datasource instance

Common mistakes: Returns most recent data unless period/start/end specified. Requires device_datasource_id (from get_device_datasources) not the datasource definition ID.

Get graph image data for visualization

List dashboards from LogicMonitor

Get detailed information about a specific dashboard

Get widgets configured on a dashboard

Get details about a specific widget

Create a dashboard, optionally from template (requires write permission)

Update an existing dashboard (requires write permission)

Delete a dashboard (requires write permission)

Add a widget to a dashboard (requires write permission). For text widgets: use 'content' (not 'html') as the config key. For bigNumber widgets: dataPoints need 'name' field, include 'bigNumberItems' array, colorThresholds use 'relation'/'threshold', aggregateFunction is lowercase (e.g., 'average'). For cgraph widgets: deviceDisplayName/deviceGroupFullPath/instanceName must be GlobMatchToggle objects {'value': '...', 'isGlob': true}, dataPoints need 'display' object, graphInfo needs 'aggregate': false when using topX. For deviceSLA widgets: required config fields are 'groupName' (not deviceGroupFullPath), 'deviceName', 'dataSourceFullName', 'metric', 'threshold'. Also required: 'daysInWeek' (e.g., '1,2,3,4,5,6,7'), 'periodInOneDay' (e.g., '0:00-23:59'), 'displayType' (0=availability, 1=timeline), 'calculationMethod' (0=percent, 1=actual), 'unmonitoredTimeAlertStatus' (0=ignore, 1=warning, 2=error, 3=critical).

Update a widget (requires write permission)

Delete a widget from a dashboard (requires write permission)

List dashboard groups

Get details about a specific dashboard group

Create a dashboard group in LogicMonitor (requires write permission)

Delete a dashboard group from LogicMonitor (requires write permission)

Update a dashboard group (requires write permission)

List websites from LogicMonitor

Get detailed information about a specific website

List website groups

Get synthetic check data for a website

Create a website check in LogicMonitor (requires write permission)

Update a website check in LogicMonitor (requires write permission)

Delete a website check from LogicMonitor (requires write permission)

Create a website group in LogicMonitor (requires write permission)

Delete a website group from LogicMonitor (requires write permission)

List reports from LogicMonitor

Get detailed information about a specific report

List report groups

Get reports with schedules configured

Run/execute a report (requires write permission)

Poll the status of a report generation task started by run_report (returns status and result URL when finished)

Create a new report (requires write permission)

Update a report's schedule (requires write permission)

Delete a report (requires write permission)

List escalation chains

Get details about a specific escalation chain

List recipient groups

Get details about a specific recipient group

Create an escalation chain (requires write permission)

Update an escalation chain (requires write permission)

Delete an escalation chain (requires write permission)

Create a recipient group (requires write permission)

Update a recipient group (requires write permission)

Delete a recipient group (requires write permission)

List LogicMonitor integrations (Custom HTTP Delivery, Slack, PagerDuty, etc.). Returns a short summary per integration.

Get a specific integration's full definition. Field set depends on integration type; password/OAuth secret fields are masked.

Create a Custom HTTP Delivery integration (type=http). Required fields: name, url. Use extra_fields for OAuth, actionNotes*, updateData*, or the 'extra' UI metadata blob. (requires write permission)

Update a Custom HTTP Delivery integration via PATCH. Only fields explicitly provided are sent; omitted fields keep their current server values. (requires write permission)

Delete an integration by ID. Works for any integration type (http, slack-2, pagerduty, etc.). (requires write permission)

List alert rules

Get details about a specific alert rule

Create an alert rule in LogicMonitor (requires write permission)

Update an alert rule in LogicMonitor (requires write permission)

Delete an alert rule from LogicMonitor (requires write permission)

List users from LogicMonitor

Get details about a specific user

List roles

Get details about a specific role

Create a user in LogicMonitor (requires write permission)

Update a user in LogicMonitor (requires write permission)

Delete a user from LogicMonitor (requires write permission)

List access groups

Get details about a specific access group

List API tokens

Get details about a specific API token

Get all properties of a device (resource)

Get a specific property of a device (resource)

Update or create a device/resource property (requires write permission)

List datasources from LogicMonitor

Get details about a specific datasource

Create a DataSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_datasource output). Use for round-tripping exports or building definitions from scratch. For LM Exchange format, use import_datasource. Script DataSource datapoints require appropriate type values.

RAW UPDATE -- full-replace semantics. Any field omitted from definition is BLANKED on the server. Two prior production incidents wiped Groovy scripts via this tool. PREFER update_logicmodule(type='datasource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Delete a DataSource definition (requires write permission). Existing collected data is retained.

List ConfigSources

Get details about a specific ConfigSource

Get update history and audit trail for a ConfigSource

List config versions collected for a device instance

Get a specific config version with full content and diffs

Trigger an on-demand config collection for a device instance

List EventSources

Get details about a specific EventSource

Get EventSources applied to a device (resource). Returns device-level EventSource associations.

Update a device-level EventSource association (requires write permission). Use to enable or disable alerting for an EventSource on a specific device.

List PropertySources

Get details about a specific PropertySource

List TopologySources

Get details about a specific TopologySource

List LogSources

Get details about a specific LogSource

Get LogSources applied to a device (resource)

List network scans

Get details about a specific network scan

Execute a network scan (requires write permission)

List OID definitions

Get details about a specific OID

List Service Insight business services (deviceType 6 devices, including APM trace services)

Get details about a specific Service Insight service

List Service Insight service groups (BizService device groups)

List ops notes

Get details about a specific ops note

Add an ops note (requires write permission)

Update an ops note (requires write permission)

Delete an ops note (requires write permission)

Get audit logs from LogicMonitor

Get API token usage audit logs

Get login/authentication audit logs

Get configuration change audit logs

Get network topology map data

Get neighboring devices/resources based on topology

Get network interfaces for a device (resource)

Get network flow data (NetFlow/sFlow)

Get device/resource relationships and connections

List batch jobs

Get details about a specific batch job

List BatchJob datasources applied to a device (resource); per-run output lives in instance data via get_device_data

Get batch jobs related to SDT automation

Get cost optimization recommendations. Category filter takes the category description string from get_cost_recommendation_categories

Get idle/underutilized cloud resources (resolved from idle-type cost recommendation categories)

Get cost recommendation categories with counts and savings

Get a specific cost recommendation by ID (v224 API)

[PREVIEW] List metric names ingested via native OpenTelemetry (OTLP). Requires the OTLP Metrics feature flag; returns a friendly notice when unavailable

[PREVIEW] List label names on native OTLP metrics, optionally narrowed to one metric

[PREVIEW] List values observed for one native OTLP metric label (e.g. all service_name values)

[PREVIEW] Run a PromQL range query against native OTLP metrics. Returns a time-series matrix

Export a datasource definition (REST API format). Output can be used with create_datasource or update_datasource.

Export a dashboard definition

Export an alert rule definition

Export an escalation chain definition

Export a ConfigSource definition (REST API format). Output can be used with create_configsource or update_configsource.

Export an EventSource definition (REST API format). Output can be used with create_eventsource or update_eventsource.

Export a PropertySource definition (REST API format). Output can be used with create_propertysource or update_propertysource.

Export a LogSource definition (REST API format). Output can be used with create_logsource or update_logsource.

Export a DiagnosticSource definition (REST API format). Output can be used with create_diagnosticsource or update_diagnosticsource.

Export a RemediationSource definition (REST API format). Output can be used with create_remediationsource or update_remediationsource.

Import a DataSource from LM Exchange JSON format via multipart upload (requires write permission). This expects LM Exchange format, not REST API format. For REST API format definitions (e.g., from export_datasource), use create_datasource instead.

Create a ConfigSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_configsource output). For LM Exchange format, use import_configsource.

RAW UPDATE -- full-replace semantics. Any field omitted from definition is BLANKED on the server. PREFER update_logicmodule(type='configsource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Delete a ConfigSource definition (requires write permission). Existing collected data is retained.

Create an EventSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_eventsource output). For LM Exchange format, use import_eventsource.

RAW UPDATE -- full-replace semantics. Any field omitted from definition is BLANKED on the server. PREFER update_logicmodule(type='eventsource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Delete an EventSource definition (requires write permission). Existing collected data is retained.

Import a ConfigSource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions (e.g., from export_configsource), use create_configsource instead.

Import an EventSource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions (e.g., from export_eventsource), use create_eventsource instead.

Create a PropertySource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_propertysource output). Use for round-tripping exports or building definitions from scratch. For LM Exchange format, use import_propertysource.

RAW UPDATE -- full-replace semantics. Any field omitted from definition is BLANKED on the server. PREFER update_logicmodule(type='propertysource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Delete a PropertySource definition (requires write permission). Existing collected data is retained.

Import a PropertySource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions (e.g., from export_propertysource), use create_propertysource instead.

Create a LogSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_logsource output). For LM Exchange format, use import_logsource.

RAW UPDATE -- full-replace semantics. Any field omitted from definition is BLANKED on the server. PREFER update_logicmodule(type='logsource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Delete a LogSource definition (requires write permission). Existing collected data is retained.

Import a LogSource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions (e.g., from export_logsource), use create_logsource instead.

Create a TopologySource via REST API from a full definition dict (requires write permission). Accepts REST API format. For LM Exchange format, use import_topologysource.

RAW UPDATE -- full-replace semantics. Any field omitted from definition is BLANKED on the server. PREFER update_logicmodule(type='topologysource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Delete a TopologySource definition (requires write permission). Existing collected data is retained.

Import a TopologySource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions, use create_topologysource instead.

Import a DiagnosticSource from LM Exchange JSON format via multipart upload (requires write permission). For REST API format definitions (e.g., from export_diagnosticsource), use create_diagnosticsource instead.

Import a JobMonitor from JSON (requires write permission)

Import an AppliesTo function from JSON (requires write permission)

Ingest log entries into LogicMonitor (requires LMv1 auth)

Push custom metrics into LogicMonitor (requires LMv1 auth)

Correlate alerts by device, datasource, and temporal proximity. Groups alerts into clusters to identify related issues.

Aggregate alert counts by severity, device, datasource, and time bucket. Returns statistical summary over a time window.

Detect metric anomalies using z-score analysis. Identifies data points deviating significantly from the mean.

Save a metric baseline from historical data. Computes mean, min, max, stddev per datapoint and stores as a session variable for later comparison.

Compare current metrics against a stored baseline. Reports deviation percentage and status (normal, elevated, reduced, anomalous) per datapoint.

Forecast when a metric will breach a threshold using linear regression. Analyzes historical data to predict trend direction and estimated breach time.

Compute Pearson correlation between multiple metric series. Builds an NxN correlation matrix and highlights strong correlations (|r| > 0.7). Maximum 10 sources.

Detect regime shifts in metric data using the CUSUM algorithm. Identifies points where the mean value changes significantly.

Score alert noise level using Shannon entropy and flap detection. Produces a score from 0 (quiet) to 100 (extremely noisy) with recommendations for tuning.

Detect periodic patterns in metric data using autocorrelation. Identifies dominant periods (1h, 4h, 12h, 24h, 168h) and peak activity hours.

Calculate availability percentage from alert history. Computes SLA-style uptime metrics, MTTR, and per-device breakdown from cleared and active alerts.

Common mistakes: hours_back defaults to 720 (30 days). Narrow scope with device_id/group_id for performance.

Analyze the blast radius of a device failure using topology data. Traverses neighbors to identify downstream impact and scores overall blast radius (0-100).

Cross-reference alert spikes with audit/change logs. Identifies changes that may have triggered alert increases using configurable correlation windows.

Score health of a specific device-datasource instance using z-score analysis. For full device health reports across all datasources, use the health_check composite tool instead.

Calculate SLO error budget consumption and projected exhaustion date. Computes remaining budget, burn rate, and status (healthy/warning/critical/exhausted) based on actual availability vs target SLO.

Classify metric trends as stable, increasing, decreasing, cyclic, or volatile. Uses linear regression slope, coefficient of variation, and autocorrelation.

Get current session context (last results, variables, history)

Set a user-defined session variable for use across tool calls

Get a user-defined session variable

Delete a user-defined session variable

Clear all session context (last results, variables, and history)

List recent tool call history

List APM trace services (deviceType:6). Entry point for discovering traced services.

Get detailed information about a specific APM trace service

Get alerts for an APM trace service

List datasources applied to an APM service (e.g. LogicMonitor_APM_Services, _Operations)

List operations (endpoints/routes) for an APM service datasource

Get APM service-level RED metrics (Duration, ErrorOperationCount, OperationCount)

Get per-operation RED metrics (Duration, ErrorOperationCount, OperationCount)

Get properties for an APM service (OTel attributes, namespace, metadata)

List DiagnosticSources from LogicMonitor

Get details about a specific DiagnosticSource including datapoints

Execute a DiagnosticSource script on a target device. Performs pre-execution checks (collector version, device status, script review) before triggering manual execution. Poll get_diagnostic_remediation_results for status and output. Requires write permission.

Create a DiagnosticSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_diagnosticsource output). For LM Exchange format, use import_diagnosticsource.

RAW UPDATE -- full-replace semantics. Any field omitted from definition is BLANKED on the server, including the script. PREFER update_logicmodule(type='diagnosticsource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Delete a DiagnosticSource definition (requires write permission). Action chains referencing it lose that stage.

List RemediationSources from LogicMonitor

Get details about a specific RemediationSource including the Groovy script

Execute a RemediationSource script on a target device. Performs pre-execution checks (collector version, device status, script review) before triggering manual execution. Requires write permission.

Create a RemediationSource via REST API from a full definition dict (requires write permission). Accepts REST API format (same as export_remediationsource output). RemediationSources have no LM Exchange import endpoint.

RAW UPDATE -- full-replace semantics. Any field omitted from definition is BLANKED on the server, including the script. PREFER update_logicmodule(type='remediationsource', id, changes, mode='preview') for partial updates with diff preview. Requires confirm=true to proceed.

Delete a RemediationSource definition (requires write permission). Action chains referencing it lose that stage.

List the diagnostic and remediation sources assigned to a specific resource or alert (Automated Diagnostics & Remediation). Unlike get_diagnosticsources/get_remediationsources, this resolves which modules actually apply to the target.

Get structured execution results for diagnostic and remediation source runs: status, trigger type, executor, script output, and timing. Provide exactly one of alert_id or host_id. Time window params are epoch milliseconds; result timestamps are epoch seconds.

List action chains: ordered DiagnosticSource/RemediationSource stages that action rules trigger on alerts (Automated Diagnostics & Remediation)

Get details about a specific action chain including its stages

Create an action chain from ordered diagnostic/remediation stages (requires write permission). Each stage references a DiagnosticSource or RemediationSource by ID.

Update an action chain via PATCH; only provided fields are sent (requires write permission)

Delete an action chain (requires write permission). Action rules referencing it stop triggering.

List action rules: alert conditions (severity, device groups, datasource matchers) that trigger action chains

Get details about a specific action rule

Create an action rule binding an action chain to alert conditions (requires write permission)

Update an action rule via PATCH; only provided fields are sent (requires write permission)

Delete an action rule (requires write permission)

Enable or disable an action rule without touching its matchers (requires write permission)

Composite triage: correlates alerts, clusters by device/time, scores noise, assesses blast radius, and checks recent changes. Returns a prioritized incident report.

Composite health check: resolves a device, scores health across datasources, detects anomalies, checks alerts, and calculates availability. Returns a single device health report.

Composite capacity planning: forecasts metric breach dates, classifies trends, detects seasonality and change points. Returns per-datasource capacity projections.

Composite portal overview: aggregates alert statistics, collector health, maintenance windows, noise scores, and dead devices into a shift-handoff report.

Composite diagnosis: given an alert or device, gathers alert details, device context, correlated alerts, recent changes, blast radius, and health score. Returns a diagnosis report with probable root cause and recommendations.

Search available MCP tools by keyword or category. Use this to discover which tools are available for a task.

Safe partial update for LogicMonitor source types (configsource, datasource, eventsource, logsource, propertysource, topologysource). Exports the current full definition, deep-merges your changes onto it, validates required fields, and either returns a dry-run diff (mode='preview', default) or applies the merged definition (mode='apply'). PREFER this over the raw update_ tools for partial updates -- the raw tools are full-replace and will blank any field omitted from the payload (two prior production incidents).

Get LogicMonitor reference content (schemas, enums, filter syntax, guides). Mirrors content from MCP Resources for clients without full Resource support (Copilot cloud agent, OpenAI Codex, Cline). Categories: schema, enums, filters, syntax, guide. Pass list=true (or omit both category and name) to discover all available (category, name) pairs.

Get LogicMonitor workflow guidance text (incident_triage, rca_workflow, remediate_workflow, etc.). Mirrors MCP Prompt content for clients without Prompt support. Prefer the composite workflow tools (triage, diagnose, health_check, capacity_plan, portal_overview) when they exist -- those execute the procedure. Pass list=true to discover available workflows.

Export an existing LogicMonitor resource as Terraform HCL configuration using the logicmonitor/logicmonitor provider. Supports device, device_group, collector, alert_rule, escalation_chain, dashboard, datasource, sdt, website, role, and report_group resource types.

Pull interface-level metrics (in/out bytes, errors, discards, utilization, status) for a device's interface over a time window. Answers 'how is this port performing?' Resolves the Interface-family DataSource and the instance matching the interface name before fetching datapoints.

Rank NetFlow flows on an exporter by bandwidth, packets, or flow count. Group by source IP, destination IP, protocol, application, or source->destination pair. Answers 'what is consuming my WAN?'

Sliding-window detector for mass alert events: N alerts from the same DataSource across M+ devices within T seconds. Answers 'did a bunch of stuff break at once?' Used for detecting cascading failures like mass interface-down events during a site outage.

Identify interfaces with repeated up/down transitions in a time window. Answers 'which ports are unstable?' Common causes: bad cable, duplex mismatch, bad SFP, PoE power cycling, WAN instability.

Enriched collector status with time-since-last-contact, downstream device count, dependent alert count, and optional CollectorDown history. Leading indicator for site-level events. Prefer this over get_collectors when investigating potential outages.

Filter alerts for UPS/PDU power-event signatures across APC, Liebert, and Eaton DataSources ('on battery', 'runtime remaining', 'input voltage lost') over a time window. Returns events matched by DataSource or alert name substring with counts per pattern.

Composite workflow for site outage detection. Chains CollectorDown detection, mass-interface-down burst analysis, UPS on-battery events, and downstream device silence into a single site-outage verdict with confidence score, scope, and affected device list. Designed to catch the class of site-outage that generic AIOps correlation misses. Pass a device group ID representing the site.

Portal audit that counts UPS/PDU devices onboarded, interface DataSources applied, SNMP credentials configured, and NetFlow exporters set up. Returns a prioritized gap list with onboarding recommendations — turns 'you can't detect X' into 'here's how to enable detection of X.'