Create Incident on behalf of End User

This document details the functional requirements and workflow for enabling IT Analysts to create incidents on behalf of end users via a chat-based AI Analyst agent. The solution aims to streamline incident logging, improve accuracy, and ensure only essential, relevant information (symptom and description) is captured.

• Create Incident for End User

• List vs Summary

Create Incident for End User

The Agent performs the following functionalities:

• Create Incident and capture End-User Details

• Derive Symptom and Description from Analyst Input

• Ask Follow-up Questions if Information is Insufficient and Restrict Data Capture

• Create Incident in ITSM and Confirm Creation

Create Incident and capture End-User Details

The AI agent is designed to streamline the process of incident creation by IT analysts on behalf of end users via chat. Leveraging natural language processing, the AI autonomously detects when an analyst intends to log an incident and ensures that all necessary end-user details are captured.

The AI can understand conversational phrases indicating the analyst’s wish to create an incident. For more information, refer to the following steps:

1. Analyst prompts the bot to create an Incident for End User.
   
   Analyst: I need to create an Incident for John.
   Agent: Checks the user list for the applicable name and provides the list of users for the Analyst to select.
   
   Figure: Create Incident for User
   

2. If the name is ambiguous, the system presents available users; analyst selects from list. Provides more option to enter at this point of the conversation as below:

   • Type Number to select the user

   • Type Cancel to undo the action

   • Type Retry to search again
     

3. Select the required user to create an Incident for then, the Agent asks for issue description.
   
   Analyst: Enters value ‘3’ to select the user.

   Agent: Creating incident for John.Miller@summit*****ai.com. Please describe the issue (type 'cancel' to cancel):

   Creating an Incident, please describe the issue.
   
   Figure: Issue Description

Derive Symptom and Description from Analyst Input

Upon entering the Description AI automatically extracts Symptom and Description from the user prompt.

• Symptom: The observed issue or behavior
  Example: “Unable to capture screenshot from Snagit tool”.
  

• Description: A more detailed account, potentially paraphrased from input, providing context or specifics
  Example: “The user is unable to capture screenshots using the Snagit application. This affects the core functionality of the tool. Type 'yes' to create, 'edit' to change description, or 'cancel'.

To validate, perform the following steps:

1. Based on the provided description, the agent composes Symptom and Description in formal tone.
   If too brief, bot requests more details else, proceeds to confirmation.
   
   Figure: Confirm Incident Creation

2. Review the Symptom and Description. Agent provides the following options to Analyst before confirming to create an Incident.

   • Type Yes to create

   • Type Edit to change description

   • Type Cancel to undo Incident creation action
     

3. Enter Yes to create an Incident. The Agent creates and Incident and provides Incident ID as a hyperlink. Click Incident ID hyperlink to view the Incident in a new tab.
   
   Figure: Incident Created

Ask Follow-up Questions if Information is Insufficient and Restrict Data Capture

The AI evaluates the data and prompts for missing details.

• Evaluate extracted data for completeness and clarity.

• Prompt the analyst for missing or unclear details, limited strictly to symptom and description.

• Never ask for or collect additional mandatory fields (example: device ID, location).

AI agent assesses if Symptom and Description are present and understandable. If unclear/missing, AI asks targeted follow-up question(s) ‘Could you please provide more details about the issue you’re experiencing’.

Figure: Follow-up Questions

Create Incident in ITSM and Confirm Creation

AI uses validated data to create the incident in the ITSM system and confirms success.

Calls the incident creation API (or appropriate backend connector) with the derived symptom and description, and the end user's details.

Upon success, AI displays confirmation: “Incident Created Successfully User: John Miller, Incident ID: xxxxx.” If creation fails, AI notifies analyst and provides error information.

Figure: Incident Creation

List Vs Summary

To support your IT operations, the Analyst Agent chatbot allows you to easily distinguish between a “list” and a “summary” of tickets. This distinction helps you quickly view assigned tickets and get concise overviews of ticket and key details when you need them.

• List of Tickets

• Summary of a Ticket

List of Tickets

A complete list of all incident or service request tickets currently assigned to you as an analyst. The bot will present the list in a clear format, often with clickable links for each ticket, so you can easily open and review individual tickets.

Analyst: Please list all my Incidents
AI Agent:

Figure: List Incidents

Summary of a Ticket

A concise overview and status update of a specific ticket. The summary includes:

• Hyperlink to the particular Incident.

• A brief of the ticket’s main symptom or description along with other fields such as Status, Priority, Category etc..

• A detailed summary of the Incident.

Use this when you need to catch up on what has happened with a particular ticket or brief yourself before taking the next step.

User: Provide Summary for Ticket No 40324
AI Agent:

📋 Summary of Incident #40324

Incident #40324

• Status: In-Progress

• Priority: P2 - High

• Category: Messaging\Storage Issue

• Workgroup: Exchange Server

• Last Updated: 2025-12-09 15:38:18

• Symptom: Test IMcustomreports

• Summary: Incident Summary:

The issue pertains to testing the "IMcustomreports" functionality. The description provided is repetitive and lacks specific details about the problem or expected outcome. The impact and urgency are both categorized as low, indicating minimal disruption to operations. No resolutions or troubleshooting steps have been documented so far. Additionally, there are no recent user or private communications providing further context or updates. Further clarification from the user is required to proceed with investigation and resolution.

Figure: Incident Summary