AI diagnosis on tickets

When Alert automation processes an alert, it records the results on a Service Desk ticket. The ticket shows what the AI found, what it recommends, and what it has already done, so a technician starts from a diagnosis instead of a raw alert.

Without alert automation, a technician has to gather this information by hand. For example, for a failed backup, they would find the device, check its status, review earlier alerts and activities, and check the client's backup policy. For a low disk space alert, they would connect to the device, run a diagnostic script, and review the results before preparing a fix. With alert automation, the agent does this investigation, and the ticket shows each step that it took, what it found, and the recommended next steps.

For example, the agent might find that a backup failed because of a network problem on the device, but that a recent backup already exists within the policy window, and another backup is scheduled soon. Or it might find what is using the disk space, and recommend steps to free it.

Some fixes need potentially risky actions on a device. These steps are left for a technician to review, so that a person stays in control of the change.

What the ticket shows

  • Problem summary and possible root causes – Generated for every new ticket, as for other tickets. For more information, see AI root cause analysis.

  • Diagnosis – When the diagnosis agent can investigate the alert type, it adds a detailed diagnosis: the steps that it took, what it found, and its explanation of the alert. Diagnosis covers a limited set of alert types in this release, so not every ticket has one.

  • Recommended actions – The steps to fix the problem, in order. Each step shows its risk level and status, and whether it is a remote command or a manual step. Steps that the AI completed are marked as completed. If the plan changes during remediation, this list is updated.

  • Activity timeline – Each action that the AI performs, such as completing a diagnosis, running a step, or resolving the ticket, is added to the ticket's activity timeline. Every change to the plan is also recorded, with who made it and when.

The ticket also shows the standard ticket fields, such as client, affected assets, linked alerts, priority, and category.

Agent traces

The full details of what each agent did are kept in an agent trace, not on the ticket. A trace shows the sequence of tools and actions that the agent used, what each one returned, and the checks that were used to verify a fix.

  • To see how the alert was diagnosed, click View diagnosis agent trace in the Diagnosis section.
  • To see how remediation ran, click View agent trace in the Recommended actions section.

If a trace is not available, the ticket content remains available, and the link shows that the trace is unavailable.

AI-diagnosed and AI-resolved tickets

Tickets from alert automation can carry two labels, which you can use to filter and report on tickets:

  • AI-diagnosed – The Alert Diagnosis Agent added a diagnosis to the ticket. The label stays on the ticket, even if a technician resolves it.
  • AI-resolved – The Alert Remediation Agent fixed the problem, the fix was verified, and the ticket was resolved without a technician. Every AI-resolved ticket is also AI-diagnosed.

If a technician resolves the ticket, the ticket stays AI-diagnosed, and is not marked as AI-resolved.

If the same alert occurs again, the existing ticket is reopened with its previous notes.