{ "name": "ServiceNow Incident - AI Triage and Response", "description": "AI-driven incident triage workflow. The Triage Agent fetches incident details from ServiceNow via MCP, classifies severity and risk, then routes: auto-remediate (known low-risk issues), approval-required (high-impact changes), or inform-only (enrich and assign). ServiceNow MCP handles all ITSM interactions natively throughout the workflow.", "schema_version": "2.0.0", "triggers": [ { "id": "trigger_manual", "name": "ServiceNow Incident Alert", "type": "manual_trigger", "config": { "input_schema": { "type": "object", "properties": { "incident_number": { "type": "string", "default": "INC0010001", "description": "ServiceNow incident number (e.g. INC0010001)" } } } }, "position": { "x": 0, "y": 300 } } ], "nodes": [ { "id": "triage_agent", "name": "AI Triage Agent", "type": "agentic", "config": { "model": "claude-sonnet-4-6", "credential_id": "b9b3529b-5211-4b9b-90f6-e37c1106919e", "prompt": "You are an IT operations AI triage coordinator. Your job is to assess a ServiceNow incident and determine the correct response path.\n\nIncident number: ${trigger.incident_number}\n\nStep 1 - Fetch the full incident record:\nCall 'servicenow-mcp::perform_query' with:\n table: 'incident'\n query: 'number=${trigger.incident_number}'\n fields: ['number', 'short_description', 'description', 'priority', 'category', 'subcategory', 'state', 'cmdb_ci', 'assignment_group', 'sys_id']\n limit: 1\n\nStep 2 - Acknowledge the incident with an internal work note:\nCall 'servicenow-mcp::add_work_notes' with:\n number: '${trigger.incident_number}'\n work_notes: 'AI triage initiated by Ansible Automation Orchestrator. Analyzing incident severity and determining response path.'\n\nStep 3 - Classify and decide a route:\nBased on the incident details, determine:\n- route:\n * 'auto_remediate' - Priority 1 or 2 with a well-understood, low-risk automated fix (service restart, disk cleanup, config reset, port unblock). Automation can resolve without human review.\n * 'needs_approval' - Priority 1 or 2 where the fix is risky or change-impacting (package upgrade, firewall rule change, data migration, network reconfiguration). Requires human sign-off before execution.\n * 'inform_only' - Priority 3-5, or any incident where automated action is not safe or appropriate. Enrich the ticket and route to the responsible team.\n- priority_label: 'Critical', 'High', 'Moderate', 'Low', or 'Planning'\n- affected_system: the CI or hostname from the incident (use 'Unknown' if not specified)\n- category: the incident category value\n- short_description: the incident short_description field verbatim\n- recommended_action: one concise sentence describing what should happen next\n- reasoning: one sentence explaining why you chose this route\n- incident_sys_id: the sys_id value from the fetched record\n\nOutput ONLY valid JSON with no additional text:\n{\n \"route\": \"\",\n \"priority_label\": \"\",\n \"affected_system\": \"\",\n \"category\": \"\",\n \"short_description\": \"\",\n \"recommended_action\": \"\",\n \"reasoning\": \"\",\n \"incident_sys_id\": \"\"\n}", "response_schema": { "type": "object", "properties": { "route": { "type": "string" }, "category": { "type": "string" }, "reasoning": { "type": "string" }, "priority_label": { "type": "string" }, "affected_system": { "type": "string" }, "incident_sys_id": { "type": "string" }, "short_description": { "type": "string" }, "recommended_action": { "type": "string" } } } }, "position": { "x": 360, "y": 300 } }, { "id": "route_switch", "name": "Route Decision", "type": "switch", "config": { "cases": [ { "port": "case_0", "label": "Auto-Remediate", "condition": "${triage_agent.result.content.route} == 'auto_remediate'" }, { "port": "case_1", "label": "Needs Approval", "condition": "${triage_agent.result.content.route} == 'needs_approval'" }, { "port": "case_2", "label": "Inform Only", "condition": "${triage_agent.result.content.route} == 'inform_only'" } ], "default_port": "default" }, "position": { "x": 720, "y": 300 } }, { "id": "auto_remediation_job", "name": "Run Auto-Remediation", "type": "aap_job_template", "config": { "diff_mode": false, "credential_id": "09381e35-ec03-45bc-b8b7-2d8a7c1c9670", "job_template_id": 22, "job_template_name": "SNOW - Auto Remediation", "organization_name": "Default", "limit": "${triage_agent.result.content.affected_system}", "extra_vars": { "incident_number": "${trigger.incident_number}", "affected_system": "${triage_agent.result.content.affected_system}", "category": "${triage_agent.result.content.category}", "recommended_action": "${triage_agent.result.content.recommended_action}" } }, "position": { "x": 1080, "y": 80 } }, { "id": "resolve_auto_agent", "name": "Resolve Incident", "type": "agentic", "config": { "model": "claude-sonnet-4-6", "credential_id": "b9b3529b-5211-4b9b-90f6-e37c1106919e", "prompt": "The automated remediation job has completed successfully for incident ${trigger.incident_number}. Close the ticket and notify the customer.\n\nStep 1 - Resolve the incident:\nCall 'servicenow-mcp::update_incident' with:\n number: '${trigger.incident_number}'\n updates: {\n 'state': '6',\n 'close_code': 'Solved (Permanently)',\n 'close_notes': 'Automated remediation executed by Ansible Automation Orchestrator. Action taken: ${triage_agent.result.content.recommended_action}. Affected system: ${triage_agent.result.content.affected_system}.'\n }\n\nStep 2 - Add a customer-visible comment:\nCall 'servicenow-mcp::add_comment' with:\n number: '${trigger.incident_number}'\n comment: 'Your incident has been automatically resolved by the Ansible Automation Orchestrator. Action taken: ${triage_agent.result.content.recommended_action}. If the issue persists, please reopen this ticket or contact the IT Operations team.'\n\nConfirm both actions completed successfully." }, "position": { "x": 1380, "y": 80 } }, { "id": "pending_approval_note", "name": "Notify - Awaiting Approval", "type": "agentic", "config": { "model": "claude-sonnet-4-6", "credential_id": "b9b3529b-5211-4b9b-90f6-e37c1106919e", "prompt": "The AI triage agent has identified a remediation for incident ${trigger.incident_number} that requires human approval before execution.\n\nCall 'servicenow-mcp::add_work_notes' with:\n number: '${trigger.incident_number}'\n work_notes: 'AI triage complete. Recommended action: ${triage_agent.result.content.recommended_action}. This change has been flagged as requiring approval due to potential impact on ${triage_agent.result.content.affected_system}. Awaiting approval in Ansible Automation Orchestrator before proceeding. Priority: ${triage_agent.result.content.priority_label}.'\n\nConfirm the work note was added." }, "position": { "x": 1080, "y": 300 } }, { "id": "approval_gate", "name": "Approve Remediation Change", "type": "approval", "config": {}, "position": { "x": 1380, "y": 300 } }, { "id": "remediation_job_approved", "name": "Run Approved Remediation", "type": "aap_job_template", "config": { "diff_mode": false, "credential_id": "09381e35-ec03-45bc-b8b7-2d8a7c1c9670", "job_template_id": 22, "job_template_name": "SNOW - Auto Remediation", "organization_name": "Default", "limit": "${triage_agent.result.content.affected_system}", "extra_vars": { "incident_number": "${trigger.incident_number}", "affected_system": "${triage_agent.result.content.affected_system}", "category": "${triage_agent.result.content.category}", "recommended_action": "${triage_agent.result.content.recommended_action}" } }, "position": { "x": 1680, "y": 300 } }, { "id": "resolve_approved_agent", "name": "Resolve Incident - Approved", "type": "agentic", "config": { "model": "claude-sonnet-4-6", "credential_id": "b9b3529b-5211-4b9b-90f6-e37c1106919e", "prompt": "The approved remediation job has completed successfully for incident ${trigger.incident_number}. Close the ticket and notify the customer.\n\nStep 1 - Resolve the incident:\nCall 'servicenow-mcp::update_incident' with:\n number: '${trigger.incident_number}'\n updates: {\n 'state': '6',\n 'close_code': 'Solved (Permanently)',\n 'close_notes': 'Approved change executed by Ansible Automation Orchestrator following human approval. Action taken: ${triage_agent.result.content.recommended_action}. Affected system: ${triage_agent.result.content.affected_system}.'\n }\n\nStep 2 - Add a customer-visible comment:\nCall 'servicenow-mcp::add_comment' with:\n number: '${trigger.incident_number}'\n comment: 'Your incident has been resolved following an approved change by the IT Operations team. Action taken: ${triage_agent.result.content.recommended_action}. If the issue persists, please reopen this ticket.'\n\nConfirm both actions completed successfully." }, "position": { "x": 1980, "y": 300 } }, { "id": "enrich_and_assign_agent", "name": "Enrich and Assign", "type": "agentic", "config": { "model": "claude-sonnet-4-6", "credential_id": "b9b3529b-5211-4b9b-90f6-e37c1106919e", "prompt": "Incident ${trigger.incident_number} has been classified as inform-only (Priority: ${triage_agent.result.content.priority_label}, Category: ${triage_agent.result.content.category}). Automated remediation is not appropriate. Enrich the ticket with context and update its status for manual handling.\n\nStep 1 - Search for related recent incidents:\nCall 'servicenow-mcp::natural_language_search' with:\n query: 'incidents similar to \"${triage_agent.result.content.short_description}\" in the last 30 days'\n\nStep 2 - Add a detailed internal work note with your analysis:\nCall 'servicenow-mcp::add_work_notes' with:\n number: '${trigger.incident_number}'\n work_notes: Summarize your analysis including: AI triage result, affected system (${triage_agent.result.content.affected_system}), priority (${triage_agent.result.content.priority_label}), recommended next action (${triage_agent.result.content.recommended_action}), reasoning (${triage_agent.result.content.reasoning}), and any patterns found in related incidents. Keep it concise and actionable for the operations team.\n\nStep 3 - Notify the customer:\nCall 'servicenow-mcp::add_comment' with:\n number: '${trigger.incident_number}'\n comment: 'Thank you for reporting this incident. Our AI Operations system has analyzed your request and assigned it for review by the IT Operations team. You can expect an update within your SLA window. Summary: ${triage_agent.result.content.short_description}.'\n\nStep 4 - Set the incident to In Progress:\nCall 'servicenow-mcp::natural_language_update' with:\n command: 'Set incident ${trigger.incident_number} state to In Progress'\n\nConfirm all steps completed successfully." }, "position": { "x": 1080, "y": 520 } } ], "edges": [ { "to": "triage_agent", "from": "trigger_manual" }, { "to": "route_switch", "from": "triage_agent" }, { "to": "auto_remediation_job", "from": "route_switch", "from_port": "case_0" }, { "to": "resolve_auto_agent", "from": "auto_remediation_job" }, { "to": "pending_approval_note", "from": "route_switch", "from_port": "case_1" }, { "to": "approval_gate", "from": "pending_approval_note" }, { "to": "remediation_job_approved", "from": "approval_gate", "from_port": "approved" }, { "to": "resolve_approved_agent", "from": "remediation_job_approved" }, { "to": "enrich_and_assign_agent", "from": "route_switch", "from_port": "case_2" } ] }