Overview The final Ski School session brought the series home with a focused look at Edwin AI and how teams can use it to reduce noise, accelerate root cause analysis, and streamline incident response. This conversation landed especially well with technical practitioners because it stayed grounded in real operational workflows , covering how Edwin AI handles alert deduplication, topology-based correlation, AI investigations, ITSM integration, and automation. The strongest signal from the audience was clear: customers are thinking seriously about how Edwin AI fits into production environments , especially where ServiceNow, CMDB data, third-party observability platforms, and custom LogicModules are already part of the stack. Key Highlights ⭐ Edwin AI was framed around three major capabilities: event intelligence, AI agents, and AI automations, helping teams move from raw event volume to actionable insights . ⭐The demo showed the scale of Edwin AI’s correlation value, with one example reducing 6,747 events ➞ 71 alerts ➞ 7 insights in a 24-hour period. ⭐Edwin AI already supports integrations like ThousandEyes and Elastic, and can also ingest data through webhooks or SDKs for additional third-party tools. ⭐ServiceNow was a major area of interest, with strong discussion around LMDX, incident lifecycle synchronization, change requests, KB enrichment, and CMDB-driven context. ⭐Alert quality questions surfaced an important takeaway: Edwin AI can tolerate noisy environments well, but alert tuning can still help reduce overall usage consumption. Q&A Q: Is it possible to add additional documentation to enhance Edwin AI, such as job aids, architectures, SOPs, or platform manuals? A: Yes, that is planned. Today, Edwin primarily pulls additional documentation from ServiceNow knowledge base articles, and the roadmap includes broader ingestion options like Confluence and SharePoint through MCP and other methods. Q: We have thousands of devices. If we apply these modules globally, what is the latency between an SNMP trap hitting the collector and Edwin successfully clustering it into an insight? A: Once the alert is generated in LogicMonitor, Edwin typically pulls it in within about 30 seconds, assuming the appropriate pipeline alert is already configured. Q: Does Edwin provide MCP or A2A to other platforms, or is this on the roadmap? A: It is on the roadmap. MCP support is actively being developed, including Confluence-related work, with a longer-term goal of letting customers configure multiple MCP connections. Q: ServiceNow incidents have two different apps, LDX and incident management for LM Envision and Edwin. Can they work together, and how do they differ? A: Edwin uses LMDX, which is more tightly connected to the incident lifecycle and supports richer AI-driven context like change requests and KB articles. It is designed to reflect incident status changes back into Edwin and support more advanced agent workflows over time. Q: If we switch to Edwin, would it provide bi-directional ticket flow with ticket numbers into LogicMonitor? A: That is the goal. Edwin is designed to work like other ITSM integrations, using unique IDs so updates can flow in both directions as tickets change. Q: Can Edwin set up coordination of data between tools like NetBox, Catalyst Center, ThousandEyes, Elastic, et cetera? A: Yes. Edwin already supports some integrations like ThousandEyes and Elastic, and other tools can send data through webhooks or an SDK, which is especially useful for on-prem or legacy systems. Q: Is the legacy LM Incident Management app in ServiceNow compatible with Edwin, or do we have to switch? A: You do have to switch to LMDX. The transition is usually straightforward, though it may require adjustments based on how your ServiceNow environment and IT operations workflows are set up. Q: Is Edwin AI's pricing based on consumption, compute, or both? If so, does it come with its own dashboard to monitor usage costs? A: Pricing is currently primarily consumption-based, including both data sent into Edwin and AI agent usage. Edwin now includes a usage page so customers can track that activity directly in the UI. Q: Is Edwin AI integrated with LogicMonitor's remediation feature, where based on the alert you can automate an actual fix on the targeted system? A: Not yet, but it is on the roadmap. Today, Edwin automation is more aligned to platforms like Ansible, with future plans to connect more deeply to LM Envision diagnostic and remediation workflows. Q: AI agents will provide the response based on the data in the tenant or other tenants/web? A: Responses are based on data from your own environment. Edwin does not use data across tenants, and it only looks outward when you explicitly ask about public third-party service status. Q: How does Edwin handle alert noise or false positives in our instance? Does lack of alert tuning impact Edwin's accuracy and performance? A: Edwin reduces noise through deduplication and correlation, and by default focuses ITSM notifications on major issues. Poor tuning can increase usage because more data is being ingested, but Sarah noted it does not materially hurt platform performance. Q: Can Edwin and Envision handle overlapping IP address space? For example, after a merger or acquisition, two enterprises might both use 10.0.0.8. Would Edwin be able to discern between two unrelated things with the same IP? A: Yes. Edwin can distinguish them using unique device display names, tagging, and correlation logic, so overlapping IPs alone do not force them to be treated as the same resource. Q: What would be general timelines to adopt Edwin AI, or how is alert and incident management handled during the transition period? A: Timelines vary, but some customers go live in about eight weeks. The biggest factor is how clearly the incident lifecycle is defined, especially in ITSM. During onboarding, the team maps existing alerting and escalation behavior into Edwin and typically recommends turning off overlapping LM Envision alert rules at go-live to avoid duplication. Q: Does Edwin AI work in sync with LM's RCA module dependency mapping? A: Partially. Edwin can achieve similar outcomes through topology-based correlation models, but it goes beyond dependent alert mapping by identifying likely causal CIs and supporting more than just host status and ping-based suppression. Q: Does Edwin AI have any integrations or ties to LM's ServiceNow CMDB application? A: Yes. Edwin can leverage CMDB data that flows through the service graph connector, using that enrichment for correlation, routing, and ITSM-related context. Q: Do we have any LM documentation on alert dependency mapping including integration with the ServiceNow CMDB app, which could help for network reporting? A: There is documentation on dependent alert mapping and on the service graph connector, but not a single source that ties the whole workflow together. Sarah noted this is an area Edwin AI aims to improve, especially through AI-generated incident reporting and topology-aware context. Q: We have a large number of custom LogicModules in our instance. Does Edwin AI play nice with custom alerts, or are they all treated the same? A: Edwin handles custom LogicModules well as long as they are uniquely named. It uses the combination of data point and data source display name to distinguish them during deduplication and correlation. Q: During the demo, I noticed the Edwin integration with Dynatrace. Can you please share some use cases on how this integration adds value? A: The value is added context across layers. Dynatrace and Datadog help teams determine whether an issue is rooted in the application layer or the network layer, which improves triage and helps teams understand true business impact faster. What's Next Finish Ski School 2026 Reminder: you have until April 5 to complete all four required badges: AIOps Adoption Resource Management Alerts Edwin AI Completing all four badges earns participants an LM beanie and entry into the raffle for a Ski School branded Solo Stove. Want to review the session? Watch the recording directly from the event page!
