The incident agent.

Today

1. 01An alarm fires and waits in the queue until an engineer picks it up.
2. 02The engineer logs in to monitoring, the controller and the carrier portal, one after another.
3. 03Recent changes and similar past incidents are checked by hand, if there is time.
4. 04The ticket is written up and escalated, often with facts missing.
5. 05The next team repeats the diagnosis before it acts.

With the agent

1. 01The agent picks up the alarm as it fires and groups related alarms into one incident.
2. 02It collects device state, traffic path and carrier status from every tool at once.
3. 03It checks recent changes and matching past incidents every time.
4. 04It opens the ticket with a diagnosis, the evidence and a proposed next step, routed to the right team.
5. 05An engineer approves or corrects the next step. The agent carries it out and keeps the ticket up to date until it closes.

• Groups related alarms into one incident
• Collects evidence from your tools
• Checks recent changes and past incidents
• Writes the diagnosis into the ticket
• Routes the ticket and notifies the owner

• Raises a case with the carrier or vendor
• Restarts an interface or a service
• Applies a fix from an approved runbook
• Sends an update to affected users
• Closes the incident

• Changes a device without approval
• Acts on devices or sites outside its scope
• Invents a fix that is not in a runbook
• Gives a diagnosis without showing its evidence

Playbooks

The triage steps your senior engineers follow, written down for each type of incident.

Site knowledge

Site notes, network diagrams, on-call contacts and the quirks only your team knows.

Inventory

Which devices and circuits serve which site, and what depends on them.

History

Past incidents, recent changes and known errors for the same devices and sites.