Active
AI Generated
AI Incident Triage
Intelligent incident response
Description
When an incident alert fires, an AI agent analyzes context, selects a remediation strategy, and routes to the appropriate AAP playbook — without hardcoded if-statements in the workflow.
Why it matters
- AI triage picks the remediation playbook from alert context instead of hardcoded if-this-then-that graphs.
- Dynamic template selection adapts when new playbooks ship without redesigning the workflow.
- Validation and notification built in so operators confirm recovery, not just job completion.
AO building blocks
Automation orchestrator step types this workflow uses on the canvas. See all building blocks
-
Triggers
Manual trigger
Starts a workflow when a user clicks Run in the UI or calls the workflow execution API — the simplest entry point for on-demand runs like demos, break-glass remediation, or operator-initiated changes. No extra configuration is required, and runs appear in history with the triggering user as the source.
-
AI & integrations
Task agent
Adds LLM reasoning to a workflow — the step receives a natural-language prompt, can call enabled tools, and returns structured output that downstream steps reference through expressions. Use it for unstructured data (logs, tickets, alerts) to summarize, classify, triage, and recommend remediation actions; pair with an approval step for human oversight.
-
Logic
Switch step
Evaluates conditions and routes execution to the first matching branch, supporting up to 100 ordered paths plus a fallback when nothing matches. Use it to branch on severity tiers, environment (dev/staging/prod), or AI agent output categories where a binary conditional isn't enough.
-
Approval
Approval step
Pauses the branch and creates an approval request; an approver reviews context, approves or rejects, and the workflow continues on the matching path. Place approvals before destructive or production changes, with configurable approver users/groups, a decision window, and fallback behavior if no one responds in time.
-
AAP execution
AAP job template
Launches a single Ansible Automation Platform job template from the workflow, polling until the job completes and exposing results to downstream steps. The standard bridge between automation orchestrator reasoning and AAP execution — one playbook with resolved inventory, credentials, limits, and extra vars.
-
AI & integrations
MCP integration
Model Context Protocol server tools that Task agents can call to read or change external systems — inventory, ITSM, vulnerability data, and more. Configure integrations under Integrations so agents work with live platform data instead of hallucinating context, choosing which tools each agent can access.
-
AI & integrations
ServiceNow MCP
An MCP integration scoped to ServiceNow that lets Task agents query incidents, update records, and close tickets without custom HTTP glue code — commonly used by triage agents that enrich incidents and resolution agents that update state after remediation completes.
Interactive Experience
Planned scope
- AI agent triages incident payload
- Dynamic playbook selection at runtime
- Post-remediation validation and operator notification
Workflow
flowchart LR
A@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/manual-trigger.png", label: "Incident Alert", pos: "b", h: 96, constraint: "on" } --> B@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/task-agent.png", label: "AI Triage Agent", pos: "b", h: 96, constraint: "on" }
B --> C@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/switch-node.png", label: "Route Decision", pos: "b", h: 96, constraint: "on" }
C -->|Auto Remediate| D@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Run Remediation", pos: "b", h: 96, constraint: "on" }
C -->|Needs Approval| E@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/approval-node.png", label: "Approve Remediation", pos: "b", h: 96, constraint: "on" }
E -->|Approved| E1@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Run Approved Remediation", pos: "b", h: 96, constraint: "on" }
C -->|Inform Only| F@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/task-agent.png", label: "Enrich and Assign", pos: "b", h: 96, constraint: "on" }
classDef noBorder fill:transparent,stroke:transparent
class A,B,C,D,E,E1,F noBorder
Playbooks
| Playbook | What it does | Runs on |
|---|---|---|
snow_auto_remediation.yml
|
Runs automated remediation on the target host for a ServiceNow incident — checks uptime, disk, and service status. | RHEL node |
AI Generated
This demo's playbooks and workflow were generated by AI to illustrate the pattern. They have not been fully tested in a live environment. Review and adapt before using in production.