Integration

Coralogix integration

Coralogix is an observability platform for logs, metrics, traces and alerts. With this API (management API v5) an agent can list, search and read incidents and their events, acknowledge, assign, resolve and close them, work Coralogix Cases (list, read, comment, assign, acknowledge, prioritize, resolve, close), read alert definitions (without their type-specific conditions) and alert events, delete an alert definition, manage alert suppression rules and SLOs (including their compliance status), and query billable data usage. Log ingestion and DataPrime queries, dashboards, views, parsing rules, enrichments, policies, notification connectors, outgoing webhooks, integrations, API keys, users, teams and other account administration are not exposed, nor creating or editing alert definitions. Raw event payloads are not returned. Authentication is a Coralogix personal or team API key sent as a Bearer token, plus the API host of the account's region.

Connect Coralogix How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Coralogix.Built from the 69 Coralogix tools below, on the connection you add once.

What you can do with Coralogix

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Event, 9 operations

get_case_eventGet case eventGETReturns one event of a Coralogix Case timeline by its event id. Needs case:Read.
get_eventGet eventGETReturns one alert event by id (a single event, or the grouped events behind it with token pagination). Raw event payloads are not returned.
get_incident_by_eventGet incident by eventGETReturns the incident an alert event belongs to, by the event id: name, status, severity, labels, assignments and timestamps. Needs incidents:read.
get_incident_event_filter_valuesGet incident event filter valuesGETReturns the values available for each incident event filter for the events matching an optional filter. Needs incidents:read.
get_incident_eventsGet incident eventsGETReturns the chronological events of one incident: state changes, assignments, acknowledgements and resolutions. Needs incidents:read.
list_alert_eventsList alert eventsGETLists the events fired by given alerts (by alert version id) in a time range, with token pagination. Raw event payloads are not returned.
list_case_eventsList case eventsGETReturns the timeline of a Coralogix Case: comments, assignments, status and priority changes, notifications and KPI breaches. Needs case:Read.
list_eventsList eventsGETLists alert events of the team matching event types, keys and a time range, with token pagination. Raw event payloads are not returned.
list_incident_eventsList incident eventsGETLists incident events (state changes, assignments, acknowledgements, resolutions) filtered by status, severity, name, labels or a time range. Page size up to 1000 (default 100). Needs incidents:read.

Slo, 5 operations

create_sloCreate sloPOSTCreates an SLO: a name, a target percentage, a rolling time frame and exactly one SLI (apmSli, requestBasedMetricSli or windowBasedMetricSli).
delete_sloDelete sloDELETEPermanently deletes an SLO.
get_sloGet sloGETReturns one SLO: SLI definition, target percentage, time frame, labels, ownership and revision.
list_slosList slosGETLists the team's SLOs with their SLI definition, target percentage, time frame and ownership.
replace_sloReplace sloPUTReplaces an existing SLO (send its id with the full definition and exactly one SLI); fields left out are not kept.

Suppression rule, 5 operations

create_suppression_ruleCreate suppression rulePOSTCreates an alert suppression rule that mutes matching alerts on a one-time or recurring schedule. Suppressed alerts send no notifications while it is active.
delete_suppression_ruleDelete suppression ruleDELETEDeletes an alert suppression rule; the alerts it muted notify again.
get_suppression_ruleGet suppression ruleGETReturns one alert suppression rule: name, filter, schedule and enabled state.
list_suppression_rulesList suppression rulesGETLists alert suppression rules (which alerts are muted and on what schedule), optionally only enabled ones, active in a time window or with given ids.
update_suppression_ruleUpdate suppression rulePUTReplaces an existing alert suppression rule (send its id with the full rule: name, filter, schedule).

Assigned, 4 operations

assign_caseAssign casePOSTAssigns a Coralogix Case to a user (assignee.userId). Needs case:Assign.
assign_casesAssign casesPUTAssigns several Coralogix Cases to one user (assignee.userId). Needs case:Assign.
unassign_caseUnassign caseDELETERemoves the assignee from a Coralogix Case. Needs case:Assign.
unassign_casesUnassign casesDELETERemoves the assignee from several Coralogix Cases. Needs case:Assign.

Priority override, 4 operations

clear_case_priority_overrideClear case priority overrideDELETERemoves the priority override from a Coralogix Case, back to its computed priority. Needs case:Update.
clear_cases_priority_overrideClear cases priority overrideDELETERemoves the priority override from several Coralogix Cases, back to their computed priority. Needs case:Update.
override_case_priorityOverride case priorityPUTSets a priority override (P1 to P5) on a Coralogix Case, replacing its computed priority. Needs case:Update.
override_cases_priorityOverride cases priorityPOSTSets the same priority override (P1 to P5) on several Coralogix Cases, replacing their computed priority. Needs case:Update.

Acknowledged, 3 operations

acknowledge_caseAcknowledge casePUTAcknowledges one Coralogix Case (case id or readable id such as CASE-123). Needs case:Acknowledge.
acknowledge_casesAcknowledge casesPOSTAcknowledges several Coralogix Cases at once, on behalf of a user (actor.userId). Case ids or readable ids such as CASE-123. Needs case:Acknowledge.
unacknowledge_caseUnacknowledge caseDELETERemoves the acknowledgement from a Coralogix Case. Needs case:Acknowledge.

Alert, 3 operations

delete_alert_definitionDelete alert definitionDELETEPermanently deletes an alert definition; it stops monitoring. Needs alerts:UpdateConfig.
get_alert_definitionGet alert definitionGETReturns an alert definition by id: name, description, type, priority, enabled, status, group-by keys and timestamps. Type-specific conditions are not returned. Needs alerts:ReadConfig.
list_alert_definitionsList alert definitionsGETLists the team's alert definitions (name, type, priority, enabled, status, last triggered) filtered by name, type, priority, status or ids. Type-specific conditions are not returned. Needs alerts:ReadConfig.

Case, 3 operations

get_caseGet caseGETReturns one Coralogix Case: title, status, priority, category, assignee, groupings, labels, impacted entities, KPI breaches, AI summary and resolution details. Needs case:Read.
list_casesList casesPOSTLists Coralogix Cases (grouped alert investigations) matching filters (status, priority, assignee, category, labels, dates and more), ordered by one field, with token pagination. Needs case:Read.
update_caseUpdate casePUTUpdates a Coralogix Case's title or resolution reason; fields left out keep their value. Needs case:Update.

Closed, 3 operations

close_caseClose casePOSTCloses a Coralogix Case that no longer needs action. Needs case:Close.
close_casesClose casesPOSTCloses several Coralogix Cases at once. Needs case:Close.
close_incidentsClose incidentsPOSTCloses one or more incidents by id. Needs incidents:close.

Comment, 3 operations

create_case_commentCreate case commentPOSTAdds a comment to a Coralogix Case timeline, visible to the team. Needs case:Comment.
delete_case_commentDelete case commentDELETEDeletes a comment from a Coralogix Case timeline. Needs case:Comment.
update_case_commentUpdate case commentPUTReplaces the text of a comment on a Coralogix Case. Needs case:Comment.

Count, 3 operations

count_alert_definitionsCount alert definitionsGETReturns how many alert definitions match each filter option (type, priority, status, enabled) for an optional filter. Needs alerts:ReadConfig.
count_eventsCount eventsGETReturns the number of alert events matching event types, keys and a time range.
count_incident_eventsCount incident eventsGETReturns the number of incident events matching a filter (status, severity, name, labels, time range). Needs incidents:read.

Incident, 3 operations

get_incidentGet incidentGETReturns one incident: name, description, status, state, severity, labels, assignments, mute flag and timestamps (its event list is left out; use get_incident_events). Needs incidents:read.
get_incidents_by_idsGet incidents by idsGETReturns several incidents by their ids in one call (a map of id to incident) and the ids not found. Needs incidents:read.
list_incidentsList incidentsPOSTLists incidents matching a filter (status, severity, application, subsystem, assignee, labels, time ranges, search query), with ordering and token pagination. Needs incidents:read.

Acknowledge, 2 operations

acknowledge_incident_by_eventAcknowledge incident by eventPOSTAcknowledges the incident an alert event belongs to, by the event id. Needs incidents:acknowledge and a personal (user-owned) API key; a team key is refused.
acknowledge_incidentsAcknowledge incidentsPOSTAcknowledges one or more incidents by id. Needs incidents:acknowledge and a personal (user-owned) API key; a team key is refused.

By user, 2 operations

assign_incidentsAssign incidentsPOSTAssigns one or more incidents to a Coralogix user (assignedTo.userId). Needs incidents:assign and a personal (user-owned) API key; a team key is refused.
unassign_incidentsUnassign incidentsDELETERemoves the user assignment from one or more incidents. Needs incidents:assign.

Filter value, 2 operations

get_case_filter_valuesGet case filter valuesPOSTReturns the values available for each Case filter (statuses, priorities, assignees, categories, labels) for the cases matching optional filters. Needs case:Read.
get_incident_filter_valuesGet incident filter valuesPOSTReturns the values available for each incident filter (applications, subsystems, assignees, severities, labels) for the incidents matching an optional filter. Needs incidents:read.

Resolve, 2 operations

resolve_incident_by_eventResolve incident by eventPOSTResolves the incident an alert event belongs to, by the event id. Needs incidents:close.
resolve_incidentsResolve incidentsPOSTResolves one or more incidents by id. Needs incidents:close.

Resolved, 2 operations

resolve_caseResolve casePUTResolves a Coralogix Case, with an optional reason. Needs case:Close.
resolve_casesResolve casesPOSTResolves several Coralogix Cases at once, with an optional reason. Needs case:Close.

Aggregation, 1 operation

list_incident_aggregationsList incident aggregationsGETReturns incident counts broken down by severity, status, state, assignee and meta label, for the incidents matching a filter (status, severity, application, subsystem, assignee, labels, time ranges). Needs incidents:read.

Alert event, 1 operation

get_alert_eventGet alert eventGETReturns one alert event by id: alert id, status, timestamp, group and permutation labels (for a grouped alert, each permutation). Raw payloads are not returned. Needs alerts:ReadConfig.

Alert event stats, 1 operation

get_alert_event_statsGet alert event statsGETReturns statistics for the given alert events. Needs alerts:ReadConfig.

Capability, 1 operation

get_data_usage_capabilitiesGet data usage capabilitiesGETReturns what query_data_usage accepts: labels to filter and group by, measurement kinds, units and per-request limits. Needs data-usage:Read.

Deep link, 1 operation

get_case_deep_linksGet case deep linksGETReturns links that open a Coralogix Case and its alert indicators in the Coralogix UI. Needs case:Read.

Get, 1 operation

get_case_by_indicatorGet case by indicatorPOSTFinds the Coralogix Case a Prometheus AlertManager alert belongs to, by the alert's fingerprint and start time. Needs case:Read.

Grouping key, 1 operation

list_case_grouping_keysList case grouping keysGETReturns the grouping keys that can be used to organize and filter Coralogix Cases. Needs case:Read.

Query, 1 operation

query_data_usageQuery data usagePOSTReturns the team's billable data usage in daily or hourly buckets (send exactly one of daily or hourly), filtered and grouped by labels from get_data_usage_capabilities. Needs data-usage:Read.

Statistic, 1 operation

get_event_statisticsGet event statisticsGETReturns statistics of alert events (value counts per label and metadata field) matching event types, keys and a time range.

Status, 1 operation

get_slo_statusGet slo statusGETReturns an SLO's lowest compliance and remaining error budget (ratios from 0 to 1) for one grouping slice over a time window, by default its configured rolling window.

Version id, 1 operation

get_alert_definition_by_versionGet alert definition by versionGETReturns an alert definition by its alert version id: name, description, type, priority, enabled, status and timestamps. Needs alerts:ReadConfig.

Use Coralogix from Claude Code, Cursor or Codex

Connect Coralogix in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Coralogix operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Coralogix

Create your workspace
Sign up free. Nothing to install.
Connect Coralogix once
Add your Coralogix connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.