Skip to main content
An agent with this tool answers a monitoring ticket from your Orion data: which node it is about, whether Orion can still reach it, which alerts are active on it, and what its values looked like when the alert started.
Automatically enabled when you configure SolarWinds Orion permissions in your agent workflow. No manual toggle needed.

​
What It Does

  • Find the node by caption, IP address, DNS name, custom property or group
  • Read the node’s status, response time, packet loss, CPU and memory, and its active alerts with their severity, trigger time and message
  • Find the alert behind a ticket an Orion alert opened, by node, alert name and trigger time, or by the incident number Orion’s own incident integration recorded
  • Acknowledge an alert, add a note or clear it, with the ticket number in the note
  • Read CPU, memory, disk, interface traffic, response time, application and hardware health over time
  • Mute and unmute a node’s alerts for a change window, and unmanage or remanage a node, interface, volume or application
  • Add a device to monitoring by ping, SNMP or WMI, let Orion find its interfaces and volumes, set its custom properties and groups, poll it now, and remove a retired device
  • Change the other Orion modules (alert definitions, applications, network configurations, virtualization, IP addresses, dashboards and settings), with the access and approvals you choose
The agent calls Orion through the Vendor API tool, with solarwinds_orion as the vendor id. Every read is a SWQL query through SWIS. Sandbox scripts can call Orion too, under the same permissions.

​
Permission Groups

Monitoring Data can be Disabled or Read Only; every other group holds changes only and can be Disabled or Read/Write. Neo removes passwords, SNMP communities, keys, tokens and device configuration text from every answer, refuses a query that names one, and never sends the calls listed under What Neo never sends.

​
Access Profiles

Monitoring Data Read Only, every other group Disabled. The agent reads, and never changes anything.
Alerts and Events is Read/Write without approval. Mute and Unmanage and Nodes and Monitoring are Read/Write with technician approval. Every other group is Disabled.
Every group Read/Write. Alert Definitions and Actions, Agents, Server, VM and Cloud Actions, Network Configuration, Security and Compliance, Credentials, Accounts and Access, and Administration require technician approval, and so does deleting a node.
Every group Read/Write without approval, except the changes that always ask a technician.