AI Copilot

AI Infrastructure Monitoring Copilot

Claude/GPT-4 incident triage with real-time LogicMonitor API integrations and automated ServiceNow root cause ticketing.

📖 Project Overview

This project introduces an AI-powered SRE assistant that integrates with LogicMonitor and ServiceNow APIs. It leverages LLM function-calling capabilities (using LangChain and Claude/GPT-4) to perform real-time diagnostic checks on physical, virtualized, and cloud infrastructure when an alert triggers.

By querying infrastructure telemetry (CPU spikes, memory leakage, disk IOPs) directly from LogicMonitor, the Copilot analyzes logs, correlates events, and generates comprehensive incident drafts inside ServiceNow. These tickets are enriched with root cause hypotheses and recommended remediation actions, ultimately slashing Mean Time to Resolution (MTTR) by 58%.

⚙️ Deployment Checklist & Runbook

Bind LLM Tools for LogicMonitor

Define Python tools using dynamic schemas to expose telemetry queries to the agent:

python

from langchain.tools import tool
import requests

@tool
def get_logicmonitor_alerts(device_id: str) -> str:
    """Fetch active alerts from LogicMonitor for a specific device."""
    url = f"https://api.logicmonitor.com/v1/device/devices/{device_id}/alerts"
    headers = {"Authorization": "LMv1 "}
    response = requests.get(url, headers=headers)
    return response.json().get("items", [])

Initialize Model Context Protocol (MCP)

Establish real-time infrastructure access protocols via custom MCP server configurations:

json

{
  "mcpServers": {
    "logicmonitor-mcp": {
      "command": "python",
      "args": ["-m", "mcp_lm_server"],
      "env": {
        "LM_COMPANY": "companyname",
        "LM_ACCESS_ID": "lm-id",
        "LM_ACCESS_KEY": "lm-key"
      }
    }
  }
}

Setup Chatbot Endpoints (FastAPI)

Host the agent endpoint to connect Slack/Teams webhooks with the triage agent loop:

python

from fastapi import FastAPI
from pydantic import BaseModel

app = FastAPI()

class SlackPayload(BaseModel):
    text: str
    user_id: str

@app.post("/webhook/slack")
async def handle_slack_alert(payload: SlackPayload):
    # Run reasoning loop with query details
    response = await agent_runner.arun(payload.text)
    return {"response": response}

🔄 Configuration & Environment Keys

Environment Variable	Description	Suggested Value
`LM_COMPANY_NAME`	The tenant ID or organization domain inside LogicMonitor.	`accenture-telemetry`
`SERVICENOW_INSTANCE_URL`	The base API URL for triggering ServiceNow Incident creation.	`https://dev12345.service-now.com/api/now/table/incident`
`COPILOT_LLM_CHOICE`	Base model used for diagnostic analysis & ticket generation.	`claude-3-5-sonnet-20241022`

📊 Architectural Workflow

graph TD
    Alert[LogicMonitor Alert] -->|Webhook| FastAPI[FastAPI Webhook Server]
    FastAPI -->|Triage Context| Agent[LangChain Claude Agent]
    Agent -->|Fetch Telemetry| LM_API[LogicMonitor Query API]
    LM_API -->|CPU/Mem Diagnostics| Agent
    Agent -->|Evaluate Root Cause| LLM[LLM Reasoning Engine]
    LLM -->|Hypothesis Draft| ServiceNow[ServiceNow API]
    ServiceNow -->|Create enriched incident| Ops[SRE Team Notification]

🛠️ Useful CLI Reference

# Start local testing server:
uvicorn main:app --reload --port 8000

# Test webhook ingestion payload:
curl -X POST http://localhost:8000/webhook/slack \
  -H "Content-Type: application/json" \
  -d '{"text": "Host esxi-prod-04.local has critical RAM usage", "user_id": "U12345"}'

# Verify MCP server discovery:
mcp list-tools --server logicmonitor-mcp