Triage and analyze alerts agentic workflow

  • Release version: Zurich
  • Updated July 31, 2025
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Triage and Analyze Alerts Agentic Workflow

    The triage and analyze alerts agentic workflow in ServiceNow leverages AI agents to automate and enhance preliminary alert management tasks, including triage, investigation, and analysis. This workflow helps you quickly acknowledge alerts, assign them to appropriate users or groups, and generate comprehensive summaries with technical insights. It also investigates relevant historical incidents to assess alert significance and suggest resolution options, thereby improving alert handling efficiency.

    Show full answer Show less

    You can access this workflow via the ServiceNow Otto panel, either directly from alerts or from the incident form or Express List. AI agents operate with role-based access controls to ensure security, and modifying the workflow requires duplicating it and updating related instructions to fit your organization’s needs.

    AI Agents and Their Roles

    The workflow employs a coordinated team of AI agents, each specialized to support different aspects of alert processing:

    • Alert Handling AI Agent: Manages alert acknowledgment, assignment, and keeps alert records current.
    • Alert Analysis AI Agent: Performs detailed analysis and updates alert descriptions as needed.
    • Alert History Analysis AI Agent: Reviews past alert occurrences to evaluate significance and can close alerts when appropriate.
    • Related Incidents Analysis AI Agent: Analyzes past incidents to provide insights on typical assignments and resolution summaries.
    • Alert Verification AI Agent: Checks completeness of alert data and decides if the alert is ready for further analysis.

    Practical Benefits for ServiceNow Customers

    By using this agentic workflow, you can expect streamlined alert lifecycle management with AI-driven automation that reduces manual effort and accelerates incident resolution. The workflow ensures that alerts are promptly triaged, contextually analyzed, and assigned to the right teams, enhancing operational efficiency and improving incident response outcomes.

    Additionally, the workflow’s design supports secure access controls and customization, allowing ServiceNow customers to tailor AI agent behavior and instructions to align with organizational policies and processes.

    Use the triage and analyze alerts agentic workflow to complete preliminary alert tasks and analysis for alerts.

    Triage and analyze alerts agentic workflow overview

    The triage and analyze alerts agentic workflow uses AI agents to support alert triage, investigation, and analysis. AI agents can perform the following functions:
    • Acknowledge alerts.
    • Assign alerts to individual users and assignment groups.
    • Summarize alert and alert group data to create a human-readable description and add technical analysis.
    • Investigate relevant past incidents to analyze the significance of the alert and present options for resolution.
    Note:
    These functions can also be used for the origin alert of an incident when the workflow is accessed from the incident form or Express List using the ServiceNow Otto panel.

    Agentic workflows and their AI agents use role masking to determine which users can access them. Ones installed with your applications have specific roles that come included with the application. If you select Users with specific roles for user access, you must configure the security controls to include these roles. For the instructions to change the security controls, see Define security controls for an agentic workflow.

    Use the information on this page to learn about the agents related to the triage and analyze alerts agentic workflow. To modify the triage and analyze alerts agentic workflow, you must duplicate it and adjust the settings according to your requirements. For more information, see Duplicate an agentic workflow.

    Important:
    When you modify an agentic workflow, AI agent, or tool, make sure that you update all instructions accordingly.

    Triage and analyze alerts agentic workflow

    Acknowledge, assign, and investigate current and past alerts to determine significance and possible resolutions.

    To access the agentic workflow, use the ServiceNow Otto panel. For more information about using the agentic workflow in the Now Assist panel, see ServiceNow Otto panel.

    AI agents used in the triage and analyze alerts agentic workflow

    The triage and analyze alerts agentic workflow uses a team of AI agents to perform preliminary tasks and support alert resolution.

    Table 1. AI agents used in the triage and analyze alerts agentic workflow
    AI agent AI agent role
    Alert handling AI agent Assign, acknowledge, and maintain an up-to-date alert record.
    Alert analysis AI agent Perform alert analysis, and update alert description, when applicable.
    Alert history analysis AI agent Analyze past occurrences, assess its significance, and close the alert when applicable.
    Related incidents analysis AI agent Analyze past incidents and provide insights on common assignments and summarized resolution notes.
    Alert verification AI agent Assess data completeness and determine whether the alert is suitable for analysis.