Critical-risk tools in Logicmonitor
34 of the 306 tools in Logicmonitor are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
bulk_delete_devicesDestructiveDelete multiple devices/resources in one operation
-
bulk_delete_sdtDestructiveDelete multiple SDTs at once (max 100, requires write permission)
-
cancel_jobDestructiveCancel a running job. Requires write permission.
-
clear_session_contextDestructiveClear all session context (last results, variables, and history)
-
delete_action_chainDestructiveDelete an action chain (requires write permission). Action rules
-
delete_action_ruleDestructiveDelete an action rule (requires write permission)
-
delete_alert_ruleDestructiveDelete an alert rule from LogicMonitor (requires write permission)
-
delete_collectorDestructiveDelete a collector (requires write permission).
-
delete_collector_groupDestructiveDelete a collector group (requires write permission).
-
delete_configsourceDestructiveDelete a ConfigSource definition
-
delete_dashboardDestructiveDelete a dashboard (requires write permission)
-
delete_dashboard_groupDestructiveDelete a dashboard group from LogicMonitor (requires write permission)
-
delete_datasourceDestructiveDelete a DataSource definition
-
delete_deviceDestructiveDelete a device/resource (requires write permission). Soft delete by default.
-
delete_device_groupDestructiveDelete a device/resource group (requires write permission). Shows impact.
-
delete_device_instanceDestructiveDelete a monitored instance from a datasource
-
delete_diagnosticsourceDestructiveDelete a DiagnosticSource definition (requires write permission).
-
delete_escalation_chainDestructiveDelete an escalation chain (requires write permission)
-
delete_eventsourceDestructiveDelete an EventSource definition
-
delete_integrationDestructiveDelete an integration by ID. Works for any integration
-
delete_logsourceDestructiveDelete a LogSource definition
-
delete_ops_noteDestructiveDelete an ops note (requires write permission)
-
delete_propertysourceDestructiveDelete a PropertySource definition
-
delete_recipient_groupDestructiveDelete a recipient group (requires write permission)
-
delete_remediationsourceDestructiveDelete a RemediationSource definition (requires write permission).
-
delete_reportDestructiveDelete a report (requires write permission)
-
delete_sdtDestructiveDelete a scheduled downtime (requires write permission)
-
delete_session_variableDestructiveDelete a user-defined session variable
-
delete_topologysourceDestructiveDelete a TopologySource definition
-
delete_userDestructiveDelete a user from LogicMonitor (requires write permission)
-
delete_websiteDestructiveDelete a website check from LogicMonitor (requires write permission)
-
delete_website_groupDestructiveDelete a website group from LogicMonitor (requires write permission)
-
delete_widgetDestructiveDelete a widget from a dashboard (requires write permission)
-
terraform_destroyDestructiveDestroy all Terraform-managed infrastructure in a workspace.
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.