remove ICM tools

Author: craigshoemaker

articles/sre-agent/incident-management-tools.md

@@ -14,7 +14,7 @@ Azure SRE Agent leverages a comprehensive suite of specialized incident manageme
 
 The tools are designed to handle various scenarios including:
 
-- **Incident Management**: Acknowledge, manage, and track incidents across ICM and PagerDuty
+- **Incident Management**: Acknowledge, manage, and track incidents in PagerDuty
 - **Resource Monitoring**: Analyze performance metrics, health status, and configuration changes
 - **Diagnostic Operations**: Collect logs, analyze memory dumps, and perform deep system analysis  
 - **Infrastructure Management**: Scale resources, modify configurations, and manage network settings
@@ -28,16 +28,12 @@ The following table provides a comprehensive list of all tools available to Azur
 
 | Tool name | Description |
 |---|---|
-| AcknowledgeIncident | Acknowledges an ICM incident |
 | AcknowledgePagerDutyIncident | Acknowledges a PagerDuty incident |
-| AddDiscussionEntryRCAContainerApp |  **Note: DO NOT CALL IT AUTOMATICALLY. ALWAYS ASK USER BEFORE CALLING IT** <br><br> Add a valid HTML-formatted message discussion entry or summary of final investigate to an ICM incident <br><br> This operation adds a discussion entry to the given IcM Incident. <br><br> input parameters: <br><br> - incidentId: The Id of the IcM incident. It is usually an integer number. <br><br> - text: A well HTML-formatted message to add as discussion to IcM. <br><br> NOTE: <br><br> - text MUST be always valid HTML formatted message <br><br> - Remove all emojis if any present. <br><br> The operation adds a discussion entry to the given incident. <br><br> The return value is a boolean value for indicating if the operation is successful. |
 | AddIgnoreTagToResource | Adds a tag to a resource to prevent it from being flagged in a scan for a specified period of time. |
-| AddKeywordToIncident | Add a keyword to an ICM incident |
 | AddParentIncidentLink | Adds a parent incident link to the given incident id |
 | AddRelatedIncidentLink | Adds a related incident link to the given incident id |
 | AddRoleAssignment | Adds a role assignment for a user or managed identity on an Azure resource |
 | AddSourceCodeNodeToContainerAppNode | Adds the GitHub repo url node and an edge from the container app node to it |
-| AddTagToIncident | Add a tag to an ICM incident |
 | AnalyzeDotnetAppMemoryInAKSContainer | Performs memory analysis for a . NET application running in a specific pod and container within an AKS cluster. <br><br> This analysis involves collecting a memory dump, running an analyzer tool inside the container, and returning the analysis results. <br><br> This tool can help identify memory leaks, high memory usage patterns, and other memory-related issues in . NET applications. <br><br> Use this tool when investigating memory problems for a . NET app in AKS. <br><br> Example: Analyze the memory of the . NET app in pod cart-service-pod-abc789 in the e-commerce namespace. <br><br> Example: My . NET app order-processor in pod proc-pod-123 seems to be using too much memory, can you analyze it? |
 | AskUserForInput | Sends the specified message to the user and indicates that you require a response to proceed. Do not use this tool for any scenario where you just need to send the user an update in a fire and forget manner. If the user responds in a manner that does not satisfactorily answer your question, use this tool again. |
 | AutoScaleApp | Create auto scale settings for app to auto scale app |
@@ -63,7 +59,6 @@ The following table provides a comprehensive list of all tools available to Azur
 | DiscoverApplications | Analyzes an Azure subscription and returns a `List<ApplicationGraph>`, where each ApplicationGraph represents a distinct application. Each ApplicationGraph contains: id, name, entryPoint (main resource Node), nodes (`List<Node>` of related resources), and edges (`List<Edge>` showing relationships). Entry points are identified from Container Apps, App Services. The function maps out application topologies, including all connected resources and relationships. Returns an empty list if no applications are found. |
 | DiscoverPrometheusMetrics | Discover available Prometheus metrics with optional filtering. |
 | DnsServerManagerOperation | Retrieve DNS server manager operations to identify any DNS resolution issues that might affect outbound connections for a specific container app pod. <br><br> This query examines logs from DNS-related components to identify configuration issues or operational problems. <br><br> <br><br> What this metric measures: <br><br> - DNS server manager operations and their outcomes <br><br> - DNS listener manager activities <br><br> - CoreDNS manager operations <br><br> - Timing and trace information for DNS operations <br><br> <br><br> When it is applicable: <br><br> Useful for correlating connection issues with DNS problems, identifying DNS configuration changes, or troubleshooting name resolution failures. |
-| DowngradeSeverity | Downgrade severity of ICM incident 2 to 3 |
 | EventHubSetLocalAuthSupport | Sets the key based local auth setting on event hub accounts microsoft.eventhub/namespaces. This procedure forces callers to use non key based authentication methods such as managed identities or service principals. |
 | ExecuteClusterKustoQuery | Executes a fully qualified Kusto query on a specific cluster and database, returning the result in JSON format. |
 | ExtractTextFromImageInGitHubIssue | Extract text from an image in a GitHub issue body or comment. The image URL is of the form https://github.com/user-attachments/assets/GUID. |
@@ -147,12 +142,9 @@ The following table provides a comprehensive list of all tools available to Azur
 | GetCustomContainerSessionEnvoyRequests | Get all failed envoy requests for a custom container session in the given time range. <br><br> This is useful to identify the issues with failed requests. <br><br> For each failed request, it returns the Status which is the status code and ResponseCodeDetails which is the envoy response code for the request. |
 | GetCustomContainerSessionLegionPoolStatus | Get the status of a custom container session legion pool for a given subscription, resource group, and session pool name. <br><br> It returns the number of pods in pool which are ready, pending, allocated and inactive. |
 | GetCustomDNSServers | Get list of custom DNS servers configured for the container app environment at start and end of time window. It also checks if custom DNS servers are configured or not. <br><br> If no data is returned then ask to validate inputs again as it should never be the case. |
-| GetCustomFields | Get ICM incident custom fields |
 | GetDeleteNetworkContainerOperation | Retrieves the delete operation details for a specific NetworkContainerID. <br><br>This tool will return all the DeleteNetworkContainer operations with detailed Message. <br><br>- If no results are returned, it means there is no delete operation for the specified NetworkContainerID within the given time range. You need to highlight it since no delete operation was found it may indicate that the NetworkContainerID is leaked. <br><br>- If the results are not empty, it means the delete operation was performed successfully or failed. The Message field will provide more details about the operation. Always show timestamp, NodeId, ContainerId, OperationName and Message fields in the result. |
 | GetDeploymentActivity | Gets Deployment Activities on the specified app |
 | GetDeploymentTimes | Get the deployment times of a Container App instance. |
-| GetDiscussionEntries | Get ICM discussion entries |
-| GetDiscussionEntriesRCAContainerApp | Get original ICM discussion entries <br><br> This operation will get all the discussion entries of the given IcM Incident. <br><br> Input parameters: <br><br> - IncidentId: The Id of the IcM incident. It is usually an integer number. <br><br> - QueryFrom: The timestamp for filter the discussion entries which are created after it. <br><br> The return value is a list of discussion entries of the given IcM Incident. Each discussion entry includes the following information: <br><br> - IncidentId: The Id of the IcM incident. <br><br> - TimeStamp: The timestamp of the discussion entry. <br><br> - ChangedBy: The user who created this discussion entry. |
 | GetDNSConfigUpdateStatus | Get DNS config update status for the container app environment for a given time frame |
 | GetEnvironmentQuota | Get Container App Environment Quota limit. <br><br> Input parameters: <br><br> - environmentResourceURL: The resource url of the container app environment. Format /subscriptions/[SubscriptionId]/resourceGroups/[resource group name]/providers/Microsoft. App/managedEnvironments/[environment name] <br><br> - region: The region of the quota needs to be set. example eastus <br><br> - quotaType: The quota type. example ManagedEnvironmentConsumptionCores <br><br> The return value is a string containing the quota limit value for the specified environment, region, and quota type. |
 | GetEnvironmentQuotaOperationResult | Get the operation result of setting Managed Environment Quota limit. <br><br>Input parameters: <br><br>- operationId: The trace id of the operation, which can be used to track the operation in the Kusto table ContainerAppsAdminEvents. <br><br>- region: The region of the quota needs to be set. <br><br> <br><br>Output: <br><br>- PreciseTimeStamp: the time when the operation is completed. <br><br>- operationStatus: the status of the operation result. <br><br>- message: Describes the set Managed Environment Quota limit operation result. |
@@ -181,11 +173,7 @@ The following table provides a comprehensive list of all tools available to Azur
 | GetFunctionAppSlotSwapHistory | Gets detailed Function App slot swap information to analyze swap operations. Retrieves chronological slot swap records, including source and target slots, operation status, and timestamps. Returns comprehensive slot swap timeline with success/failure information. |
 | GetGeneralHealth | Retrieves dashboard metrics for a specific Azure resource and generates an AI-powered health summary. This function is useful when you need to: 1) Get a quick health assessment of a resource/general health of the resource for questions like 'how is my resource doing?', 2) Understand performance trends and potential issues, 3) View summarized metrics without accessing the Azure portal, or 4) Get actionable insights about resource behavior. The resources themselves also have a health score cord, use this method for verbose analysis. The output is a text summary that describes the resources health status, important metrics, and any anomalies or concerns. |
 | GetHostRuntimeErrorEvents | Gets host runtime error events from the activity logs for an Azure Function App |
-| GetIcmCorrelationAndLinkingRules | This tool identifies potential relationships between incidents. Invoke this tool whenever the user requests assistance with finding related, parent, or child incidents; especially when conditions such as time windows, title matching, or shared patterns are specified. The rules are applied internally to guide the agents actions without being returned to the user. |
 | GetImageReferenceFromResourceId | Gets the container image reference from a resource ID |
-| GetIncidentInfo | Get ICM incident details |
-| GetIncidentInfoRCAContainerApp | Get original ICM incident information. |
-| GetIncidentRepairItems | Get repair items associated with an ICM incident |
 | GetInputPressureOnLogProcessor | Get Input Pressure on Log Processor for the managed Kubernetes cluster, segmented by node or VMSS over a specified time range. <br><br> <br><br> What this metric measures: The query calculates the total records input to log-processor. <br><br> <br><br> When it is applicable: Anomaly in this indicates high resource pressure on the log-processor. |
 | GetIssueInvestigationTimeRangeRCAContainerApp |  Calculates the effective time range for issue investigation based on the available input parameters. <br><br> At least one of the following must be provided: issueFirstOccurrence, issueLastOccurrence, or reportedIssueObservedOnTime. <br><br> **Important:** <br><br> - Do NOT use this function if none of the input parameters are available. |
 | GetJobDefinition | Retrieve the Container Apps job definition (spec) for a given Container App Job <br><br>Projects: <br><br> - Timestamp: Timestamp of the job definition. More than 1 row indicates change in job defintion(spec). <br><br> - Configuration: Configuration details for the job, like trigger type, retries, job deadlines, completion times <br><br> parallelism for the job, container registry, assigned identity details. <br><br> - Template: Job template containing job containers details, cpu, memory resource details. <br><br> - Labels: Labels for the job. It has the managed environment name and workload profile name for the job. <br><br> - Status: Status of the container app Job. It has jobRunningState and jobProvisioningState. <br><br> Possible values are for jobRunningState: Running, Suspended. <br><br> Possible values for jobProvisioningState: Provisioned, Failed. |
@@ -298,7 +286,6 @@ The following table provides a comprehensive list of all tools available to Azur
 | ListRevisions | List all revisions for a container app by its resource ID. |
 | ListSubscriptions | Returns a list of all Azure subscription IDs present in the knowledge graph. This function is useful when you need to: 1) Discover available subscriptions, 2) Verify subscription visibility to the agent, 3) Get subscription IDs for use with other commands, or 4) Perform an inventory of monitored subscriptions. The output is a list of subscription IDs without additional details. |
 | ListWorkloadRevisions | List all revisions for a specific Kubernetes workload (Deployment or StatefulSet) and sort by revision number. <br><br>For deployments, it fetches ReplicaSets owned by the deployment. <br><br>For StatefulSets, it fetches ControllerRevision objects. <br><br>Used whenever user wants to check the revision history of a workload. <br><br>eg: show me all revisions of the nginx deployment in the default namespace. |
-| MitigateIncident | Mitigate ICM incident |
 | ModifyContainerAppScaleRule | Adds a new scaling rule to a Container App. Use this to define custom scaling behavior based on CPU, HTTP traffic, Azure Queue length, or any scaler from the scaler list. |
 | ModifyGrafanaDashboard | Modifies an existing Grafana dashboard based on user-requested changes or creates a new one from a template. Dashboard can be specified by name or UID. |
 | NotifyUser | Sends the specified message to the user. Use this to send updates about your current task as you are working on it. Do not use this for asking questions to the user, only for status updates. |
@@ -311,7 +298,6 @@ The following table provides a comprehensive list of all tools available to Azur
 | PlotPieChart | Generates a pie chart from the provided data and returns (or posts) it. <br><br>Parameters: <br><br>chartTitle: The title displayed at the top of the pie chart. <br><br>dataPoints: Semicolon-separated items in format sliceLabel｜value, for example: Category A｜45;Category B｜30;Category C｜25. <br><br>description: A short message to summarize the image. |
 | PlotScatter | Generates a scatter plot from X-Y coordinate pairs and returns (or posts) it. <br><br>Parameters: <br><br>chartTitle: The title displayed at the top of the scatter plot. <br><br>xAxisLabel: Label for the X-axis. <br><br>yAxisLabel: Label for the Y-axis. <br><br>dataPoints: Semicolon-separated items in format x｜y｜label, <br><br>Example: 1.2｜3.4｜Point A;2.3｜4.5｜Point B;3.4｜5.6｜Point C <br><br>description: A short message to summarize the image. |
 | PlotTimeSeriesData | Generates a base64-encoded chart from time-series data. <br><br>Used whenever giving a comparison to user. Example: how many of my total monitored apps basic auth enabled <br><br> <br><br>Arguments: <br><br>title: for example, Application Metrics Dashboard <br><br>yAxisLabel: for example, Usage (%) <br><br>yAxisMin: numeric, for example, 0 <br><br>yAxisMax: numeric, for example, 100 <br><br>dataPoints: semicolon-separated list of data points, each in the format: <br><br>2024-01-25T10:30:00｜75.｜CPU Usage For multiple points, separate each with a semicolon: <br><br>2024-01-25T10:30:00｜75.4｜CPU Usage;2024-01-25T10:35:00｜82.1｜Memory Usage <br><br>description: text to accompany the chart when posting the image |
-| PostDiscussionEntry | Post ICM discussion entry |
 | PowerOnVirtualMachine | Power ON an Azure virtual machine |
 | ProfileDotnetAppCpuInAKSContainer | Performs CPU profiling for a . NET application running in a specific pod and container. <br><br> The analysis (topN report) is also performed inside the container, and its result is returned. <br><br> Failures during tool installation or profiling will be reported in the output. <br><br> eg: Profile CPU of my-app-pod in default for 60s. |
 | PublishDashboardWithPrometheusDataSource | Publishes a dashboard with a linked Prometheus data source in a single operation |
@@ -321,8 +307,6 @@ The following table provides a comprehensive list of all tools available to Azur
 | RemoveParentIncidentLink | Removes a parent incident link from the given incident id |
 | RemoveRelatedIncidentLink | Removes a related incident link from the given incident id |
 | RemoveRoleAssignment | Removes a role assignment for a user or managed identity on an Azure resource |
-| ResolveIncident | Resolve ICM incident |
-| ResolveIncidentRCAContainerApp | Resolve an ICM incident. This operation will set the given IcM Incident to Resolved state. And you must give a reason of this resolve action. <br><br> **Note: Always confirm with the user before resolving the ICM incident, or proceed only if the user has already provided confirmation** <br><br> <br><br> Input parameters: <br><br> - incidentId: The Id of the IcM incident. It is usually an integer number. <br><br> - reason: Usually it is a reason why you can resolve this incident. <br><br> The operation will mark the given incident as resolved. The return value is a boolean value for indicating if the operation is successful. |
 | ResolvePagerDutyIncident | Resolves a PagerDuty incident |
 | RestartContainerApp | Restarts a container app. Use this to restart a container app to resolve transient issues that may be fixed by restarting the instance. |
 | RestartWebApp | Restart an AppService app |
@@ -355,7 +339,6 @@ The following table provides a comprehensive list of all tools available to Azur
 | SuggestNextSku | Given a current sku suggest a possible next sku |
 | ToolName | Description |
 | TrackSwiftILBGreKeyConflicts | This function queries the NetworkServiceManagerEvents table to identify Swift network container errors related to GRE key conflicts in environments using Internal Load Balancers (ILB). <br><br>This is particularly useful for diagnosing issues where internal traffic fails to route correctly due to overlapping GRE keys. |
-| TransferIncident | Transfer ICM incident |
 | TriggerFunctionAppSync | Triggers a sync operation on a Function Apps host to check for runtime errors or refresh the function app |
 | UpdateAppSettings | Updates specific configuration values in the App Settings for a given Azure resource. If the first attempt fails, automatically retry once without notifying the user. |
 | UpdateContainerImage | Updates the container image for a Container App. This enables changing to a new image version or completely different image. Returns detailed information about the update operation including success status, original image, new image, and reasons for failure if applicable. Note that this tool requires explicit users approval before it can be used. |