# Alerts Manage the full lifecycle of [Coralogix Alerts](https://coralogix.com/docs/user-guides/alerting/introduction-to-alerts/index.md) directly from your AI agent. The MCP server provides a unified tool to create, retrieve, update, and delete alerts—and generate infrastructure-as-code definitions from any alert configuration. Go from a natural-language prompt to a deployed alert or an IaC module in a single conversation. ## Tool All alert operations are handled by a single unified tool: `manage_alerts`. | Action | Description | | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `create` | Create a new alert. The agent always asks you to specify a priority (P1–P5) before creating. | | `get` | Retrieve a specific alert by ID. | | `list` | List alerts with an optional case-insensitive name filter. | | `update` | Update an existing alert. The agent retrieves the current configuration first, then applies your changes. | | `delete` | Delete an alert by ID. If you only have the alert name, use `list` first to find the ID. | | `generate_openapi` | Generate the OpenAPI JSON payload for use with the Coralogix REST API. | | `generate_kubernetes` | Generate a Kubernetes Operator YAML manifest for the [Coralogix Operator](https://coralogix.com/docs/developer-portal/infrastructure-as-code/coralogix-operator/index.md). | | `generate_terraform` | Generate Terraform HCL for the [Coralogix Terraform Provider](https://coralogix.com/docs/developer-portal/infrastructure-as-code/terraform-provider/coralogix-terraform-provider/index.md). | IaC generation actions work with both existing and newly described alerts. To export an existing alert, retrieve it first with `get` or `list`, then pass it to the generation action. You can also describe an alert from scratch and generate IaC without creating it in Coralogix. ## Supported alert types The tool supports all 12 Coralogix alert types: | Alert type | Key | | ---------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | | [Logs Threshold](https://coralogix.com/docs/user-guides/alerting/create-an-alert/logs/threshold-alerts/index.md) | `logsThreshold` | | [Logs Anomaly](https://coralogix.com/docs/user-guides/alerting/create-an-alert/logs/anomaly-detection-alerts/index.md) | `logsAnomaly` | | [Logs Immediate](https://coralogix.com/docs/user-guides/alerting/create-an-alert/logs/immediate-notifications/index.md) | `logsImmediate` | | [Logs New Value](https://coralogix.com/docs/user-guides/alerting/create-an-alert/logs/new-value-alerts/index.md) | `logsNewValue` | | [Logs Ratio Threshold](https://coralogix.com/docs/user-guides/alerting/create-an-alert/logs/ratio-alerts/index.md) | `logsRatioThreshold` | | [Logs Time-Relative Threshold](https://coralogix.com/docs/user-guides/alerting/create-an-alert/logs/time-relative-alerts/index.md) | `logsTimeRelativeThreshold` | | [Logs Unique Count](https://coralogix.com/docs/user-guides/alerting/create-an-alert/logs/unique-count-alerts/index.md) | `logsUniqueCount` | | [Metric Threshold](https://coralogix.com/docs/user-guides/alerting/create-an-alert/metrics/threshold-alerts/index.md) | `metricThreshold` | | [Metric Anomaly](https://coralogix.com/docs/user-guides/alerting/create-an-alert/metrics/anomaly-detection-alerts/index.md) | `metricAnomaly` | | [Tracing Immediate](https://coralogix.com/docs/user-guides/alerting/create-an-alert/traces/tracing-alerts/index.md) | `tracingImmediate` | | [Tracing Threshold](https://coralogix.com/docs/user-guides/alerting/create-an-alert/traces/tracing-alerts/index.md) | `tracingThreshold` | | [SLO Threshold](https://coralogix.com/docs/user-guides/slos/alerts/index.md) | `sloThreshold` | ## Example prompts ### Create an alert ```text Create a P2 logs threshold alert that fires when the error count in the payment-service exceeds 100 in a 5-minute window. ``` ### List and filter alerts ```text List all alerts with "latency" in the name. ``` ### Update an alert ```text Change the threshold on my "API Error Rate" alert from 100 to 50. ``` The agent retrieves the alert first, then applies your changes. ### Delete an alert ```text Delete the alert named "Legacy - Disk Usage". ``` ### Generate Terraform for a new alert ```text Generate Terraform HCL for a P2 logs threshold alert that fires when error count exceeds 100 in 5 minutes for the payment-service. ``` ### Generate Terraform from an existing alert ```text Generate the Terraform HCL for my "API Error Rate" alert. ``` The agent retrieves the alert, then renders the Terraform resource definition. ### Generate Kubernetes YAML from an existing alert ```text Generate the Kubernetes Operator YAML for my "High Error Rate" alert. ``` ### Create and export in one conversation ```text Create a P3 logs threshold alert that fires when login failures exceed 50 in 10 minutes, then generate the Terraform HCL and Kubernetes YAML for it. ``` ### Bulk export ```text List all alerts with "production" in the name and generate Terraform HCL for each one. ``` ## Important behaviors - **Priority is always user-specified.** The agent prompts you for a priority level (P1–P5) before creating an alert. It does not assign a default. - **Update requires retrieval first.** To update an alert, the agent retrieves the current configuration using `get` or `list`, then applies your changes. - **IaC generation requires the full alert definition.** For existing alerts, the agent retrieves the alert first. For new alerts, describe the configuration and the agent generates IaC without creating the alert in Coralogix. - **Full type coverage.** Every alert type available in the Coralogix platform has a dedicated schema, giving you the same granularity as the UI. ## Next steps Manage log transformation during ingestion with [Parsing Rules](https://coralogix.com/docs/user-guides/mcp-server/tools/parsing-rules/index.md).