How do I filter for assignment group and ci in the incident trends analyzer AI agent?

[Renee Yu1]

I am trying to use Incident Trends Analyzer AI agent for a specific assignment group and a list of CIs that they are interested in.  I copied the out of box agent and tried to enhance it so that it understands to filter the records by assignment group and CI.  But it's not working.   It is not filtering by the assignment group or the CI.  It's returning results from all incidents.  Below are the steps that I told the agent to do.  What am I missing?

1. Accept a start and end date/time from the user to define the analysis window.
2. Query the Incident table for records where Assignment Group = TESTABC group.
3. Filter those records to keep only incidents whose Configuration Item name contains TESTDEF.
4. Exclude any incident that does not meet the TESTDEF criteria.
5. For the remaining incidents, analyze the incident details to diagnose the exact problem.
6. Perform root‑cause analysis using incident notes, error codes, and related CI data.
7. Summarize findings for each incident, highlighting common patterns or recurring issues.
8. Generate clear, actionable recommendations to prevent similar incidents in the future.
9. Present the analysis report to the user in a concise, readable format.

[rpriyadarshy]

@Renee Yu1  for Prompt lines 2,3 & 4 -- I hope you incorporated the same in Tool Also.

As OOTB AI Agent do not accept any Parameters to Run - analyze incident trends.

In your Prompt you are supplying a date Range and More Filters - Please check in the defined TOOLs its is being passed and acted Accordingly.

===Sample add ons ======

When the user asks for trend analysis, check if they mention

- assignment group

- CI

Use parameters: {{assignment_group}} and {{cmdb_ci}}.

If these are missing, ask clarifying questions like:

"Which assignment group should I analyze?" or

"Which CI do you want to focus on?"

=====================

Behind the scenes Incident Analyzer uses GAF (Group Action Framework) which has a default filter for CLOSED Incident Only. Based on this Clustering is done and then AI Agent consumes this Data. 

Regards

RP

[Matthew_13 · Accepted solution]

Hi Buddy,

What’s missing is that you only told the agent what to think, not what data it’s allowed to see.

In ServiceNow AI agents, instructions like the steps you listed do not constrain the query. The agent will analyze whatever incidents the underlying tool returns. Since the OOB Incident Trends Analyzer pulls incidents broadly (usually just by date), the AI is correctly analyzing all incidents it receives.

That’s why:

• It works logically on paper

• But still returns incidents from every assignment group and CI

The fix is not in the agent steps. The fix is in the data retrieval layer.

In plain terms:

• Assignment group and CI filtering must be enforced in the query/tool

• The agent cannot reliably filter records after retrieval

Two common misses:

• Filtering by CI name instead of cmdb_ci (sys_id)

• Assuming the agent will honor extra filters that the tool doesn’t support

What you need to do:

• Update or replace the incident retrieval tool (Flow, data broker, scripted skill, etc.)

• Add assignment_group = TESTABC and cmdb_ci IN <CI sys_ids> directly to that query

• Pass only those filtered incidents to the agent

Once the agent only receives the right incidents, your analysis steps will work as expected.

@Renee Yu1 - Please mark Accepted Solution and Thumbs Up if you found Helpful!