Agent Skill · Axiom

axiom-alerting

Create and manage Axiom monitors and notifiers via the v2 public API. Use when building alerting, routing notifications, validating monitor behavior, and maintaining alert configurations end-to-end.

View SKILL.md on GitHub → Source repository Provider profile
Provider: Axiom Path in repo: skills/axiom-alerting/SKILL.md

Skill body

Axiom Alerting

You manage alerting in Axiom end-to-end: notifiers for routing and monitors for detection.

API Overview

Base URL: https://api.axiom.co/v2/ with Bearer token auth from .axiom.toml (project root or ~/.axiom.toml).

Monitors (/v2/monitors)

Operation Method Path
List GET /v2/monitors
Get GET /v2/monitors/{id}
History GET /v2/monitors/{id}/history
Create POST /v2/monitors
Update PUT /v2/monitors/{id}
Delete DELETE /v2/monitors/{id}

Notifiers (/v2/notifiers)

Operation Method Path
List GET /v2/notifiers
Get GET /v2/notifiers/{id}
Create POST /v2/notifiers
Update PUT /v2/notifiers/{id}
Delete DELETE /v2/notifiers/{id}

Prerequisites

  1. Run scripts/setup
  2. Ensure .axiom.toml has a deployment:
[deployments.prod]
url = "https://api.axiom.co"
token = "xaat-your-token"
org_id = "your-org-id"

Scripts

Core:

Monitor scripts:

Notifier scripts:

  1. Create notifier first.
  2. Create monitor and set notifierIds.
  3. Validate monitor behavior with monitor-history.
  4. Iterate monitor thresholds and schedule.

Workflow: End-To-End Alerting

  1. Run scripts/setup.
  2. List existing notifiers with scripts/notifier-list <deployment> and reuse one if appropriate.
  3. If no suitable notifier exists, create one with scripts/notifier-create.
  4. Create or update the monitor with notifierIds attached.
  5. Validate with scripts/monitor-history <deployment> <id> <startTime> <endTime>.
  6. If behavior is noisy or silent, tune threshold, rangeMinutes, intervalMinutes, and N-of-M trigger fields.
  7. Re-check history after each change.

Best Practices

Monitor Types And Operators

Monitor types:

Operators:

Monitor Field Reference

Core fields:

Threshold and evaluation fields:

Advanced behavior fields:

Type-specific fields:

Minimal Valid Monitor Examples

Threshold:

{
  "name": "High Error Count",
  "type": "Threshold",
  "aplQuery": "['logs'] | where status >= 500 | summarize count()",
  "operator": "Above",
  "threshold": 100,
  "rangeMinutes": 5,
  "intervalMinutes": 5,
  "notifierIds": ["notifier-id"],
  "triggerAfterNPositiveResults": 2,
  "triggerFromNRuns": 3,
  "disabled": false
}

MatchEvent:

{
  "name": "Error Event Match",
  "type": "MatchEvent",
  "aplQuery": "['logs'] | where level == 'error'",
  "rangeMinutes": 5,
  "intervalMinutes": 5,
  "notifierIds": ["notifier-id"],
  "disabled": false
}

AnomalyDetection:

{
  "name": "CPU Anomaly",
  "type": "AnomalyDetection",
  "aplQuery": "['metrics'] | summarize avg(cpu_usage)",
  "columnName": "cpu_usage",
  "operator": "AboveOrBelow",
  "rangeMinutes": 5,
  "intervalMinutes": 5,
  "notifierIds": ["notifier-id"],
  "disabled": false
}

Minimal Valid Notifier Examples

Email:

{
  "name": "Oncall Email",
  "properties": {
    "email": {
      "emails": ["oncall@example.com"]
    }
  }
}

Slack:

{
  "name": "Oncall Slack",
  "properties": {
    "slack": {
      "slackUrl": "https://hooks.slack.com/services/T.../B.../XXX"
    }
  }
}

Custom webhook:

{
  "name": "Oncall Custom Webhook",
  "properties": {
    "customWebhook": {
      "url": "https://api.example.com/alerts",
      "body": "{\"action\":\"{{.Action}}\",\"monitorID\":\"{{.MonitorID}}\"}"
    }
  }
}

Troubleshooting

401 Unauthorized:

403 Forbidden:

404 Not Found on get/update/delete:

400 Bad Request on notifier create/update:

400 Bad Request on monitor create/update:

Monitor created but never alerts:

Too many alerts (noisy monitor):

Notifier exists but no delivery: