[READ] Active alerts with dedup/rollup by message (SolarWinds or PRTG).

Rolls up storms (e.g. interface-flap repeats) into one counted entry so the signal isn't buried under duplicates.

Args: target: Monitoring target name from config; omit for the default.

[WRITE][risk=medium] Acknowledge one active alert (reversible triage action).

Pass dry_run=True to preview (reports the platform whose acknowledge API would be called — the three platforms take different endpoints and different id shapes, so it is the part of this call most worth confirming first).

Args: alert_id: Alert id (AlertActiveID on SolarWinds, sensor objid on PRTG, problem event id on Zabbix). dry_run: If True, preview without acknowledging. target: Monitoring target name from config; omit for the default.

[READ] List PRTG sensors (objid, sensor, device, status, message, lastValue).

Args: status: Optional PRTG status code to filter by (e.g. "5" for down). target: PRTG target name from config; omit for the default.

[READ] Detailed status for one PRTG sensor (name, status, lastvalue, ...).

Args: sensor_id: PRTG sensor object id (objid). target: PRTG target name from config; omit for the default.

[READ] List monitored PRTG devices (objid, device, host, status, group).

Args: target: PRTG target name from config; omit for the default.

[READ] List PRTG device groups with their rollup status.

Args: target: PRTG target name from config; omit for the default.

[READ] Historic data points for one PRTG sensor over the recent window.

Args: sensor_id: PRTG sensor object id (objid). hours: Look-back window in hours (default 24). target: PRTG target name from config; omit for the default.

[READ] System-wide PRTG sensor counters (up/down/warning/paused/alarms).

Args: target: PRTG target name from config; omit for the default.

[READ] Active PRTG alarms — sensors in a down state (status 5).

Args: target: PRTG target name from config; omit for the default.

[WRITE][risk=medium] Pause a PRTG object; reversible via resume_sensor.

Open-ended when minutes is 0, otherwise auto-resumes after minutes.

Args: object_id: PRTG object id (sensor/device/group) to pause. minutes: Auto-resume after this many minutes; 0 pauses indefinitely. message: Pause message shown in PRTG. target: Monitoring target name from config; omit for the default.

[WRITE][risk=medium] Resume a paused PRTG object (inverse of pause_sensor).

Args: object_id: PRTG object id to resume. target: Monitoring target name from config; omit for the default.

[WRITE][risk=medium] Time-boxed maintenance window (a pause of minutes).

Requires minutes > 0 — maintenance windows are never open-ended.

Args: object_id: PRTG object id to place in maintenance. minutes: Maintenance duration in minutes (must be > 0). target: Monitoring target name from config; omit for the default.

[READ] One SolarWinds node's health by caption or IP (Orion.Nodes).

Args: name_or_ip: Node caption or IP address to look up. target: SolarWinds target name from config; omit for the default.

[READ] List SolarWinds nodes, optionally filtered by status.

Args: status: Optional Orion status filter (1=Up, 2=Down, 3=Warning). target: SolarWinds target name from config; omit for the default.

[READ] Interface status + utilization (Orion.NPM.Interfaces).

With top set, sets truncated: true when more interfaces existed than were returned — the whole table is fetched and ranked before the cut, so the flag is measured rather than inferred.

Args: top: If given, return only the top-N interfaces by peak utilization. target: SolarWinds target name from config; omit for the default.

[READ] Volumes at/above a fill threshold (Orion.Volumes), worst first.

Args: min_percent: Minimum percent-used to include (default 0 = all). target: SolarWinds target name from config; omit for the default.

[READ] SAM application status (Orion.APM.Application); resilient if absent.

Args: target: SolarWinds target name from config; omit for the default.

[READ] Top-N SolarWinds nodes by a health metric.

Returns {"nodes": [...], "returned": N, "metric": str, "error": str | None}. A non-null "error" means the SWQL query failed — the opposite finding from "no nodes are under load", so never report one as the other.

Args: metric: One of cpu, memory, latency, packetloss. n: How many nodes to return (default 10). target: SolarWinds target name from config; omit for the default.

[READ] One-shot NOC glance: down/warning counts + top-3 worst CPU nodes.

Args: target: SolarWinds target name from config; omit for the default.

[READ] Most recent SolarWinds Orion events (newest first).

Sets truncated: true when more events exist than were returned.

Args: top: Number of events to return (newest first). target: SolarWinds target name from config; omit for the default.

[READ] Nodes unmanaged now or with a scheduled future unmanage window.

Args: target: SolarWinds target name from config; omit for the default.

[READ] Objects currently in an alert-suppression (muted) window.

Args: target: SolarWinds target name from config; omit for the default.

[WRITE][risk=medium] Time-boxed alert suppression for an entity. Inverse: unmute_alerts.

Args: entity_uri: SWIS entity URI to suppress (e.g. from list_muted / SWQL). minutes: Suppression window length in minutes. target: SolarWinds target name from config; omit for the default.

[WRITE][risk=medium] Resume alerts for an entity (lift suppression).

Args: entity_uri: SWIS entity URI to resume (from list_muted). target: SolarWinds target name from config; omit for the default.

[WRITE][risk=medium] Schedule a bounded maintenance window for a node.

An end time is REQUIRED — no open-ended maintenance.

Args: node_id: Numeric Orion NodeID. start_iso: Window start (ISO-8601 UTC timestamp). end_iso: Window end (ISO-8601 UTC timestamp) — required. target: SolarWinds target name from config; omit for the default.

[WRITE][risk=high] Unmanage a node — masks its monitoring. Inverse: remanage_node.

Pass dry_run=True to preview. Reversible → remanage. An end time is required (no open-ended unmanage).

Args: node_id: Numeric Orion NodeID. start_iso: Unmanage window start (ISO-8601 UTC timestamp). end_iso: Unmanage window end (ISO-8601 UTC timestamp) — required. dry_run: If True, preview without unmanaging. target: SolarWinds target name from config; omit for the default.

[WRITE][risk=medium] Return a node to managed state (lift unmanage).

Args: node_id: Numeric Orion NodeID. target: SolarWinds target name from config; omit for the default.

[WRITE][risk=high] Permanently delete a node from Orion. IRREVERSIBLE — no undo.

Pass dry_run=True to preview (reports the node's caption).

Args: node_id: Numeric Orion NodeID to delete. dry_run: If True, preview without deleting. target: SolarWinds target name from config; omit for the default.

[READ] List the canned-SWQL library (name + description).

These answer the most-repeated SolarWinds SWQL questions directly — run one with swql_canned instead of hand-writing the query.

Args: target: Monitoring target name from config; omit for the default.

[READ] Run a named canned SWQL query (e.g. nodes_down, flapping_interfaces).

Returns the same envelope as swql_query: {"rows": [...], "returned": N, "limit": L, "truncated": bool}. truncated is measured against the full result set — do not treat a capped result as the complete answer.

Args: name: Canned query name (from swql_library). params: Optional query params (e.g. {"min": 90} for a threshold). target: SolarWinds target name from config; omit for the default. limit: Maximum rows to return. Default 1000.

[READ] Run a validated read-only SWQL SELECT (row-capped).

Only SELECT is permitted — state changes go through the governed write tools. Returns {"rows": [...], "returned": N, "limit": L, "truncated": bool}; when truncated is true the query matched more rows than were returned — narrow the query or raise the limit rather than treating it as the full set.

Args: query: A SWQL SELECT statement. params: Optional named parameters referenced as @name in the query. target: SolarWinds target name from config; omit for the default. limit: Maximum rows to return. Default 1000.

[READ] List recorded, not-yet-applied undo tokens (most recent first).

Each entry names the original tool, the inverse tool that undo_apply would run, and a human note. Use the undoId with undo_apply.

Returns {"undos": [...], "returned": N, "limit": L, "truncated": bool}. truncated is measured (one extra row is fetched), not guessed from a length coincidence: when it is true there are MORE tokens than shown, so re-run with a higher limit rather than reporting the list as complete.

Each entry carries effectVerified. False means the original write lost its response, so the change it reverses is PROBABLE, not confirmed — check the live state before applying, and do not report the result as a restore of a state that may never have been reached.

Args: limit: Max rows to return (default 50, capped at 500). target: Unused (undo state is host-local); accepted for CLI uniformity.

[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.

The inverse runs through its own governed tool, so it is audited and its risk_level recorded there. Pass dry_run=True to preview the inverse call without executing it. A token can only be applied once.

Args: undo_id: The undoId from undo_list (or an _undo_id in a write result). dry_run: If True, preview the inverse tool + params without running it. target: Passed through to the inverse tool when it accepts a target.

[READ] Current Zabbix problems (active alerts) with mapped severity levels.

Args: min_severity: Only problems at this Zabbix severity (0-5) or above. target: Zabbix target name from config; omit for the default.

[READ] Zabbix hosts with interfaces + owning groups (health inventory).

Args: target: Zabbix target name from config; omit for the default.

[READ] Zabbix host groups (ids + names, for inventory and maintenance).

Args: target: Zabbix target name from config; omit for the default.

[READ] Zabbix triggers, by default only those currently firing (PROBLEM).

Args: only_problems: If True (default), only triggers in PROBLEM state. target: Zabbix target name from config; omit for the default.

[READ] Most recent Zabbix trigger events (newest first).

Sets truncated: true when more events exist than were returned; re-run with a higher top rather than treating the result as the whole history.

Args: top: Number of events to return (newest first, capped at 500). target: Zabbix target name from config; omit for the default.

[READ] Bounded metric detail for one Zabbix item (meta + history points).

Sets truncated: true when the item had more points in the window than were returned — the series you got is the most recent slice, not all of it.

Args: item_id: Zabbix item id (from the host's items). hours: Look-back window in hours (capped at 168). limit: Max history points to return (capped at 500). target: Zabbix target name from config; omit for the default.

[READ] Zabbix maintenance windows with their hosts/groups and periods.

Args: target: Zabbix target name from config; omit for the default.

[WRITE][risk=medium] Create a time-boxed Zabbix maintenance window.

Requires minutes > 0 (never open-ended) and at least one host or group id. Reversible: the undo deletes exactly the maintenance id this call created.

Args: name: Maintenance window name shown in Zabbix. minutes: Window length in minutes (must be > 0). host_ids: Host ids to cover (from zabbix_hosts). group_ids: Host-group ids to cover (from zabbix_hostgroups). target: Zabbix target name from config; omit for the default.

[WRITE][risk=high] Delete a Zabbix maintenance window. IRREVERSIBLE — no undo.

Pass dry_run=True to preview (reports the window's full definition). The BEFORE definition lands in priorState.

Args: maintenance_id: Maintenance id to delete (from zabbix_maintenances). dry_run: If True, preview without deleting. target: Zabbix target name from config; omit for the default.