Active
TMM Created
Ticket Enrichment
Intelligent Ticket Enrichment and Incident Remediation
Description
ServiceNow posts an incident number to a webhook. An AI triage agent fetches the ticket via ServiceNow MCP, discovers available AAP job templates, and classifies the incident into one of three routes — auto-remediate, needs-approval, or inform-only. A switch step routes the workflow accordingly. Auto-remediate and approved paths launch a dynamic AAP job template selected by the triage agent. The inform-only path uses a second AI agent to enrich the ticket, search for related incidents, and assign it for manual handling. Every path ends with an Update SNOW Ticket step.
Why it matters
- AI triage classifies incidents and selects the remediation playbook at runtime — no hardcoded template lists or per-incident-type workflow forks.
- Three-way switch routing matches how operations teams actually respond — auto-fix low-risk, approve risky changes, enrich and assign everything else.
- The Triage Agent reads incident data via ServiceNow MCP, while the Enrich and Assign agent reads and writes — searching related incidents, adding work notes, and notifying the customer. Ticket state updates flow through the Update SNOW Ticket job template.
- Dynamic job template expression means new remediation playbooks work without changing the workflow.
AO building blocks
Automation orchestrator step types this workflow uses on the canvas. See all building blocks
-
Triggers
Webhook trigger
Starts a workflow when an external system sends an authenticated HTTP POST to a generated endpoint URL, with the request body available as trigger input for downstream steps. Commonly used to integrate CI/CD pipelines, monitoring tools, or Splunk alerts — each workflow gets its own unique URL path.
-
AI & integrations
Task agent
Adds LLM reasoning to a workflow — the step receives a natural-language prompt, can call enabled tools, and returns structured output that downstream steps reference through expressions. Use it for unstructured data (logs, tickets, alerts) to summarize, classify, triage, and recommend remediation actions; pair with an approval step for human oversight.
-
Logic
Switch step
Evaluates conditions and routes execution to the first matching branch, supporting up to 100 ordered paths plus a fallback when nothing matches. Use it to branch on severity tiers, environment (dev/staging/prod), or AI agent output categories where a binary conditional isn't enough.
-
Approval
Approval step
Pauses the branch and creates an approval request; an approver reviews context, approves or rejects, and the workflow continues on the matching path. Place approvals before destructive or production changes, with configurable approver users/groups, a decision window, and fallback behavior if no one responds in time.
-
AAP execution
AAP job template
Launches a single Ansible Automation Platform job template from the workflow, polling until the job completes and exposing results to downstream steps. The standard bridge between automation orchestrator reasoning and AAP execution — one playbook with resolved inventory, credentials, limits, and extra vars.
-
AI & integrations
MCP integration
Model Context Protocol server tools that Task agents can call to read or change external systems — inventory, ITSM, vulnerability data, and more. Configure integrations under Integrations so agents work with live platform data instead of hallucinating context, choosing which tools each agent can access.
Interactive Experience
Workflow
flowchart LR
A@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/manual-trigger.png", label: "ServiceNow Trigger", pos: "b", h: 96, constraint: "on" } --> B@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/task-agent.png", label: "AI Triage Agent", pos: "b", h: 96, constraint: "on" }
B --> B1@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Update SNOW Ticket", pos: "b", h: 96, constraint: "on" }
B1 --> C@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/switch-node.png", label: "Route Decision", pos: "b", h: 96, constraint: "on" }
C -->|Auto Remediate| D1@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Run Auto Remediation", pos: "b", h: 96, constraint: "on" }
D1 --> D2@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Update SNOW Ticket", pos: "b", h: 96, constraint: "on" }
C -->|Needs Approval| E0@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/approval-node.png", label: "Approve Remediation", pos: "b", h: 96, constraint: "on" }
E0 -->|Approved| E1@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Run Approved Remediation", pos: "b", h: 96, constraint: "on" }
E1 --> E2@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Update SNOW Ticket", pos: "b", h: 96, constraint: "on" }
C -->|Inform Only| F1@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/task-agent.png", label: "Enrich and Assign", pos: "b", h: 96, constraint: "on" }
F1 --> F2@{ img: "https://ansible-tmm.github.io/aap-orchestrator-demos/assets/icons/launch-aap-job-template.png", label: "Update SNOW Ticket", pos: "b", h: 96, constraint: "on" }
classDef noBorder fill:transparent,stroke:transparent
class A,B,B1,C,D1,D2,E0,E1,E2,F1,F2 noBorder
Switch routing
| Route | Condition | Action |
|---|---|---|
auto_remediate |
Priority 1–2, low-risk fix, matching AAP template | Run dynamic AAP job template → Update SNOW ticket (resolved) |
needs_approval |
Priority 1–2 risky fix, or Priority 3 with risk flags | Approval gate → Run approved remediation → Update SNOW ticket (resolved) |
inform_only |
Priority 4–5, or no matching AAP template | Enrich and Assign agent (search related incidents, add work notes, notify customer) → Update SNOW ticket |
Playbooks
| Playbook | What it does | Runs on |
|---|---|---|
update_snow_ticket.yml
|
Looks up a ServiceNow incident by number, posts triage work notes, and updates ticket state. Adds close code and close notes when resolving (state 6). | localhost (ServiceNow API) |
remediate_disk_cleanup.yml
|
Clears app session storage, removes large log files and compressed archives, forces log rotation, cleans dnf cache, and publishes before/after disk stats as artifacts. | RHEL target host |
remediate_process_cleanup.yml
|
Identifies and kills high-CPU processes above a configurable threshold, cleans up PID markers, and publishes before/after CPU stats as artifacts. | RHEL target host |
Demo video
Demo ideas
- Fire a P1 disk-cleanup incident and watch auto-remediate run the dynamic job template end to end
- Fire a P2 firewall-change incident to trigger the approval gate and walk the needs-approval path
- Fire a P4 informational incident to show the Enrich and Assign agent searching for related tickets
- Compare to the linear Ticket Enrichment Arcade — same ITSM, now with switch routing and approval
- Walk through the Interact Arcade end to end