Skip to main content

Manage AI Incident Assistant Workflows

The AI Incident Assistant Workflows module within the web app allows you to create channel hawks and scheduled workflows. These allow you to set up agentic workflows that occur either when a specific word or phrase is detected, or on a specific schedule that you configure. Use these modules to set up workflows that invoke action plans or prompts based on specific scenarios that you configure. 

Prompt addendums and prompt templates

Prompt addendums provide additional instructions to the LLM for how AI Incident Assistant should handle user queries.

Prompt templates allow you to create a standard format for how AI Incident Assistant should present query responses.

See the Prompt Addendums and Prompt Templates documentation for more information.

Key Features

  • Configure workflows that trigger based on new messages in your chat channels.

  • Invoke action plans or prompts during specific scenarios.

  • Schedule workflows that occur at specific intervals. 

Channel Hawks

Channel hawks allow AI Incident Assistant to watch a channel for specific messages that trigger an agentic workflow. Workflows can invoke one or more Action Plans or follow specific prompts that you create.

Channel hawk example

You could set up a channel hawk in an on-call channel that watches for messages asking who the current on-call point of contact is. When AI Incident Assistant detects messages containing these phrases, it then runs the On-Call Retrieval action plan and posts a message in the channel. 

biggy_webapp_channelhawk.png

The following information about each channel hawk is displayed in the list:

  • Name - the name of the channel hawk.

  • Actions - the number of actions configured for the channel hawk. Hover over the number to view the types of actions.

  • Channels - the channel(s) where the channel hawk is configured.

  • Enabled - whether or not the channel hawk is enabled.

Click the Manage button next to any channel hawk in the list to view, edit, or delete it.

Use the Search bar at the top of the page to find a specific channel hawk.

Generate a New Channel Hawk

AI Incident Assistant can automatically generate channel hawks based on a short description of a workflow. 

Example description

Below is an example of a workflow description prompt:

Generate a detailed troubleshooting workflow which includes observability data, ITSM data, and provides a detailed summary of the findings. 

To generate a new channel hawk:

  1. On the Channel Hawks page, click + New Channel Hawk. 

  2. In the upper right corner of the page, select Generate Workflow.

  3. In the Workflow Generator window, enter a Description of the workflow you'd like to create. Be sure to include clear, detailed instructions in plain language. 

  4. Click Generate Workflow. 

  5. The Channel Hawks configuration page is populated based on your description. Review each field to ensure that the workflow meets your needs. 

    Detailed descriptions of each field are available in the Manually Create a New Channel Hawk instructions.

  6. If you want to start over, click Rollback to erase the content from all fields. To add information to the prompt, click Refine and enter additional instructions. If the content looks good, click Accept. 

  7. Once you are satisfied with the content, scroll to the bottom of the page and click Save. 

Manually Create a New Channel Hawk

You can create a new channel hawk from scratch without using AI Incident Assistant's generation feature. 

To create a new channel hawk:

  1. On the Channel Hawks page, click + New Channel Hawk.

  2. In the Create Channel Hawk section of the screen, configure the following fields:

    Field

    Description

    Enabled

    Use the Enabled toggle to choose whether the channel hawk will be enabled or disabled upon creation.

    Name

    Enter a descriptive name for the channel hawk.

    Slack/Teams Channels

    Select one or more channels where the channel hawk will watch for triggers.

    Always Respond

    When enabled, AI Incident Assistant will always post a workflow result message, even if it does not find any useful information.

  3. In the Trigger Condition section, specify when AI Incident Assistant should execute the workflow. You can enter a specific prompt, or select Always Execute to always run the workflow.

    Generation Mode

    Use the Generation Mode button to allow AI Incident Assistant to generate a prompt based on your input.

  4. (Optional) In the Result Message Prompt section, customize how AI Incident Assistant combines and formats the outputs from all workflow actions into a single message. Enter a specific prompt, or use the Generation Mode button to allow AI Incident Assistant to generate a prompt based on your input.

    Behavior without a custom prompt

    Without a custom prompt, AI Incident Assistant will generally default to displaying each action's output separately in sequence.

  5. In the Actions section, you can add actions that AI Incident Assistant will take when the channel hawk is triggered. Click + Add Action to create an action.

  6. In the Create Workflow Action screen, configure the following fields:

    Field

    Description

    Action Type

    Select whether you would like the workflow to be based on a System Prompt or Action Plan.

    System Prompt

    This field only appears if you select System Prompt in the Action Type menu.

    Enter a system prompt with instructions for what AI Incident Assistant should do when this workflow action is executed. Use the AI Generation button to allow AI Incident Assistant to generate a prompt based on your input.

    Action Plan

    This field only appears if you select Action Plan in the Action Type menu.

    Select an action plan that will be performed when the workflow action is executed.

    Prompt Addendum (Optional)

    This field only appears if you select Action Plan in the Action Type menu.

    Enter a prompt addendum containing additional instructions for the action plan.

  7. (Optional) Repeat steps 6-7 to add additional actions.

  8. Click Save.

Scheduled Workflows

Scheduled workflows allow you to create multi-action agentic functions that automatically occur at specific times or intervals. You can schedule any workflow to fully automate your prompts, action plans, and decision points. Monitor scheduled agentic results by configuring the workflow to post the results to a channel or email address. 

Scheduled workflow example

You can configure a scheduled workflow to invoke the Generate Channel Summary action plan during an on-call handoff, so that the next shift can quickly get caught up on what has occurred.

biggy_webapp_scheduledworkflows.png

The following information about each scheduled workflow is displayed in the list:

  • Name - the name of the workflow.

  • Actions - the number of actions configured. Hover over the number to view the types of actions.

  • Channels - the channel(s) where the workflow is configured.

  • Next Run - the date and time when the workflow will run next.

  • Schedule - the scheduled interval for when the workflow will run. 

  • Enabled - whether or not the workflow will run at the next scheduled interval.

Click the Manage button next to any workflow in the list to view, edit, or delete it.

Use the Search bar at the top of the page to find a specific workflow.

Generate a New Scheduled Workflow

AI Incident Assistant can automatically generate scheduled workflows based on a short description of a workflow. 

Example description

Below is an example of a workflow description prompt:

Generate a shift change workflow that summarizes reported incidents from the past 12 hours in a chat channel, lists any P1/P2 incidents created within the past 12 hours, and includes pending action items for the new shift to action. 

To generate a new scheduled workflow:

  1. On the Scheduled Workflows page, click + New Scheduled Workflow. 

  2. In the upper right corner of the page, select Generate Workflow.

  3. In the Workflow Generator window, enter a Description of the workflow you'd like to create. Be sure to include clear, detailed instructions in plain language. 

  4. Click Generate Workflow. 

  5. The Scheduled Workflows configuration page is populated based on your description. Review each field to ensure that the workflow meets your needs. Click Apply to apply the generated configuration.

    Detailed descriptions of each field are available in the Manually Create a Scheduled Workflow documentation.

  6. If you want to start over, click Rollback to erase the content from all fields. To add information to the prompt, click Refine and enter additional instructions. If the content looks good, click Accept. 

  7. Once you are satisfied with the content, scroll to the bottom of the page and click Save. 

Manually Create a New Scheduled Workflow

You can create a new scheduled workflow from scratch without using AI Incident Assistant's generation feature. 

To create a new scheduled workflow: 

  1. On the Scheduled Workflows screen, select + New Scheduled Workflow. 

  2. In the Create Scheduled Workflows section, configure the following:

    Field

    Description

    Name

    Enter a name for the scheduled workflow.

    Description (Optional)

    Enter a description of the scheduled workflow. 

    Enabled

    Choose whether or not you would like the scheduled workflow to be enabled upon creation.

  3. In the Schedule section, define the intervals for when AI Incident Assistant should execute the workflow:

    Field

    Description

    Repeat every

    Choose how often you would like the scheduled workflow to repeat. All workflows take place in your local time zone.

    Enter an interval number and select a time format. You can choose from:

    • Minutes (maximum 59, minimum 15)

    • Hours (maximum 24)

    • Days (maximum 31)

    • Weeks (maximum 1)

    • Months (maximum 12)

    Repeat on

    This field appears only if you selected the time format of Weeks or Months. 

    Select the day of the week or month that you would like the workflow to repeat on. 

    At

    This field appears only if you selected the time format of Hours, Days, Weeks, or Months. 

    Select the minute or time of day that you would like the workflow to repeat on. 

  4. In the Actions section, configure your workflow steps.. To add an action to the list, click + Add Action.

  5. In the Create Workflow Action screen, configure actions. Choose from System Prompt, Action Plan, or Decision action types, then configure the following fields:

    Field

    Description

    System Prompt

    This field only appears if you selected the System Prompt action type. 

    Enter a system prompt that defines what AI Incident Assistant should do when this step is executed. Use the AI Generation button to have AI Incident Assistant generate a complete, detailed prompt based on your input.

    Action Plan

    This menu only appears if you selected the Action Plan action type. 

    Select one of your configured action plans to use when this workflow is triggered. 

    Action Instructions (Optional)

    This field only appears if you selected the Action Plan action type. 

    Provide any instructions to help AI Incident Assistant successfully execute the action plan. These instructions tell AI Incident Assistant:

    • the goal of the action in the context of the larger workflow

    • how to transform the previous action's output into useful input for this action

    Decision Prompt

    This field only appears if you selected the Decision action type. 

    Enter a conditional logic prompt to determine  whether or not the workflow continues based on the results of the previous action.

  6. Click Add to complete the step and add it to the scheduled workflow.

  7. (Optional) Repeat steps 5-6 to add additional actions. 

  8. (Optional) Adjust the order of actions by dragging and dropping them into place.

    biggy_webapp_actions.png

  9. In the Response Behavior section, determine when AI Incident Assistant posts workflow results. You can choose to always post results, or specify conditions for when AI Incident Assistant shares results. Use the Always Respond toggle to choose between these options. 

  10. (Optional) If Always Respond is toggled off, you can enter a Condition Prompt for when AI Incident Assistant posts the workflow results. If a condition prompt is not provided, AI Incident Assistant will use its best judgment to determine when to post workflow results. 

  11. (Optional) In the Result Message Formatting section, enter a Formatting Prompt to customize how AI Incident Assistant combines and formats the outputs from all workflow actions into a single result message.

  12. In the Output Results section, configure the following fields to let AI Incident Assistant know where workflow responses should be sent:

    Field

    Description

    Send Results to Channels

    Enable this field to send the results of the scheduled workflow to the channel(s) you select. 

    Channels

    Select one or more channels to send the results of the workflow. 

    Send as Email

    Enable this field to deliver workflow responses to one or more email addresses.

    If you enable this field, enter email addresses in the box below separated by commas. 

  13. Click Save.

Major Incident Management (MIM) Templates

Major Incident Management (MIM) workflows automate and accelerate major incident management with preset actions.

When starting a major incident, AI Incident Assistant will prompt you to select a MIM template. For more information about handling major incidents, see the Manage Major Incidents documentation. 

As major incident management processes vary across services and scenarios, you can configure multiple templates.

Configure MIM templates in the web app at Workflows > MIM Templates. 

biggy_config_mimtemplates.png

In the MIM Templates list, you can see information about each existing template:

  • Template Name

  • Description

  • Number of actions

  • Number of entities

  • Last updated time

  • Status (Enabled or Disabled)

To make a template the default, click the Star icon. Default templates appear first in the selection list when initiating a MIM. 

To edit an existing template, click the Pencil icon. 

To create a new MIM template from an existing one, click the Clone icon. 

To delete a template, click the Trash Can icon.

Use the Search bar at the top of the page to find a specific template.

Create or Update a MIM Template

To create a new MIM template, click New Template. 

Choose between the Guided Setup, Quick Start, or Start from Scratch. 

Clone a template

If your organization has already created one or more MIM templates, you can create a new template using an existing one.

Use the Clone button to copy an existing template. Choose a unique name for the new template. You can then edit or add fields to the new cloned template. 

biggy_mim_newtemplate.png

The Guided Setup walks you through each step of creating the template in a step-by-step wizard. This option is especially helpful if it's your first time creating a MIM template. 

Quick Start creates a basic preset template containing an incident announcement, recurring status updates, and a resolution summary.

After finishing the guided setup or quick start, you can edit any fields as needed in the full template builder.

To open the full, blank template builder, select Start from Scratch.

biggy_config_mimtemplateconfig.png

At the top left of the page, use the Template Status toggle to determine whether the template is active or inactive. Only active templates can be selected when initiating a major incident.

Populate the Template Details, Communication Entities, and Actions Timeline sections to create a new template:

Template Details

In the Template Details section, provide basic information to help other users understand the template's purpose.

Field

Description

Template Name (Required)

A clear, descriptive name for the template.

Description

Details about how and when this template should be used.

Incident Priority

Select whether the incident priority is predetermined in this template, or if it should be chosen at MIM creation. 

Select one of the following options:

  • Set on MIM Creation - users select the priority each time they create a MIM using this template. 

  • Preselect in Template - the same priority is always used whenever this template is selected. If you select this option, choose the Default Priority from the drop-down menu. 

Communication Entities

In the Communication Entities section, configure which channels or communication sources (such as chat channels, ServiceNow tickets, or emails) will be monitored for updates, used to post automated actions, or used for on-call paging. Multiple communication entities can be added to a single MIM template.

If your template has existing communication entities, basic information about each entity will be displayed in the Communication Entities section of the template. 

biggy_webapp_mimcommunication.png

To add a new communication entity, click the + button on the right side of the Communication Entity section, or + Add First Entity to open the Add Communication Entity page. 

biggy_config_mimcommunicationentity.png

 Populate the following information:

Field

Description

Entity Type (Required)

Select the communication channel used for this entity. This channel can gather context, push updates, or be used for paging, depending upon the selected entity type or usage context. 

The following entity types are available: 

  • Meeting URL

  • MS Teams Chat/Meeting

  • MS Teams Channel

  • Slack Channel

  • Email

  • ServiceNow Ticket

  • On-Call Paging

The options that appear in the list will depend on integrations configured for AI Incident Assistant. 

Note: If you select MS Teams Chat/Meeting, users will need to select an existing chat when starting the major incident. If you need automatic creation, we recommend using a Teams Meeting which includes a chat.

Label (Required)

A descriptive name for the communication entity. 

Hint Text 

Additional information to help users understand the purpose of the communication entity. 

Usage Context

How the communication entity will be used. This section will only appear if you selected Meeting URL, MS Teams Chat/Meeting, MS Teams Channel, Slack Channel, Email, or ServiceNow Ticket as the Entity Type. 

Select one or both of the following:

  • Context Source - AI Incident Assistant will ingest and aggregate content from this entity to gain context and awareness. Information gathered can be used to power actions. 

    Emails cannot be used as a context source. 

  • Output Destination - Automated actions can be posted from AI Incident Assistant to this communication entity. 

    Meeting URLs cannot be used as an output destination. 

Required Entity

This setting will only appear if you selected Meeting URL, MS Teams Chat/Meeting, MS Teams Channel, Slack Channel, Email, or ServiceNow Ticket as the Entity Type. 

Select the box to require users to provide a value for this entity when creating the incident. 

Include Banner Message

This section only appears if you selected MS Teams Channel, MS Teams Chat/Meeting, or Slack Channel as the Entity Type and Output Destination for the Usage Context. 

When enabled, AI Incident Assistant will post and continuously update the incident banner message with the title, status, impact, and key findings.

ServiceNow Tables

This section only appears if you selected ServiceNow Ticket as the Entity Type. 

Add one or more ServiceNow table names. Users will input record numbers from the tables entered here when creating the incident. 

Biggy Spotter Agent

This section only appears if you selected MS Teams Channel, MS Teams Chat, or Slack Channel as the Entity Type. 

The Biggy Spotter Agent actively listens to the channel, and when an intent to perform an action is detected, it identifies potential risks and suggests steps to complete the action.

Select the Biggy Spotter Agent behavior:

  • Always active - AI Incident Assistant always monitors the channel and contributes to the incident by default. 

  • User controlled - Users specify whether they'd like to enable the agent when creating the incident.

  • Disabled - The Biggy Spotter Agent is excluded from this channel. 

When should we select this channel?

This section only appears if you selected MS Teams Channel or Slack Channel as the Entity Type. 

Choose when this channel should be selected. Select from the following options: 

  • Set when executing the MIM - Users will input this channel when creating a new major incident.

  • Create this channel automatically - Automatically create this channel when the MIM automation starts, and reuse it for all actions.

  • Preset the value now - Define the channel now and it will automatically be available for all MIM automations using this template.  If you select this option, choose a Teams channel from the drop-down menu. 

When should we collect these email addresses?

This section only appears if you selected Email as the Entity Type. 

Choose when an email address should be selected. Select from the following options: 

  • Set when executing the MIM - Users will input the email address when creating a new MIM automation.

  • Preset the value now - Define the email addresses now and it will automatically be available for all MIM automations using this template. 

Paging Configuration

This section only appears if you selected On-Call Paging as the Entity Type.

Configure settings related to your on-call tool. Populate the following fields:

  • Paging Service - the on-call service used to page responders. Only tools you have integrated are selectable. 

  • Paging Mode - how users will pick the paging targets during a major incident. The following options area available:

    • Paging Directory - users can pick from a pre-configured paging target directory.

    • All Available - users can search any target from the source system.

    • Static - fixed targets are always paged automatically when a major incident is created. 

  • Custom Message Template (Optional) - custom description used when paging. Default is blank. 

  • Default Paging Targets - This option only appears if you selected Paging Directory or Static as the Paging Mode. Select the targets that will be selected by default when creating the major incident. Paging targets will only appear as a selectable option if they have been configured in the integration. See the On-Call Integrations documentation for more information. 

Click + Add Entity to add the communication entity.

You can edit or delete any existing communication entity. In the list of communication entities, click the Pencil icon to edit a communication entity, or click the Trash Can icon to delete an entity.

Actions Timeline

In the Actions Timeline section, define automated actions. Use automated actions to automatically update stakeholders, or invoke action plans or custom prompts. 

If actions have already been configured for this template, a timeline of when each configured action occurs during a major incident is provided. For each action, basic information about what occurs during execution is displayed.

biggy_webapp_mimtimeline.png

Output destination

There must be at least one communication entity configured as an output destination to add an action. 

Click the + button to open the Add Action page. 

biggy_config_mimaction.png

Populate information in the following sections:

Section

Description

Basic Information

Contains descriptive information about the action that helps other users understand its purpose. Populate the following fields:

  • Action Title - descriptive title for the action

  • Description - optional summary of what the action does

Schedule

Determine what type of schedule the action should follow. 

In the Schedule Type field, select from the following options:

  • On Creation - action occurs once when the incident opens.

  • One-Time - action occurs only once at a specified time. When this schedule type is selected, choose the amount of time after the incident begins when the action should occur. 

  • Recurring - action occurs at a recurring interval. When this schedule type is selected, choose the interval at which the action reoccurs. The minimum interval is every 10 minutes. 

  • On Resolution - action occurs when the incident is resolved. 

Context Sources

Determine whether all context sources defined in the Communication Entities should be used to aggregate information and content. 

In the Use All Context Sources field, toggle on to aggregate content from all communication entities marked as context sources. 

Toggle off and the Select Specific Specific Sources field will appear, where you can choose one or more specific communication entities.

Context Lookback Period

Choose whether AI Incident Assistant will evaluate context from the start of the incident or only since the last action occurred.

Select From Incident Start to always analyze the full context from incident creation to now. 

Select From Last Execution to only analyze the new context available since the last action occurred. 

Skip when no meaningful updates

This option only appears if you selected One-Time, Recurring, or On Resolution as the Schedule Type.

When this option is enabled, actions will not be posted if nothing substantiative has happened in the context sources since the last action. A record of the action will still be logged in the timeline.

Output Destinations

Choose where the content generated by AI Incident Assistant will be posted. 

In the Post to all output destinations field, toggle on to send the content to all configured output destinations. 

Toggle off and the Select Specific Destinations field will appear, where you can choose a communication entity.

Execution

In the Execution section, choose what type of execution you'd like to take place when this action occurs. 

You can choose from the follow exection types:

  • Prompt - Generate content from a freeform prompt instruction. This option does not use action plans.

    In the Prompt Instruction field, describe in natural language what content AI Incident Assistant should generate for this action. 

  • Action Plan - Run an existing action plan and post the results. 

    Select an Action Plan from the drop-down menu, and optionally enter Action Instructions to help AI Incident Assistant learn how to effectively execute the action.

  • Alpha Agent - Begin an autonomous multi-step investigation and execution. This option can use multiple action plans as well as the instructions in the prompt itself. 

    In the Alpha Agent Instructions field, describe in natural language the steps that the alpha agent should perform. The agent will determine what tools or action plans to use for each step. 

    Example:

    1. Check monitoring in Datadog for affected services 

    2. Look up related incidents in BigPanda 

    3. Check ServiceNow for recent changes to impacted systems 

    4. Summarize findings and recommend next steps 

Approval Settings

Choose whether you would like to require approval prior to posting the AI-generated content. 

Click the Require Human Approval box to require a review of the draft before posting. 

If this option is selected, the user who starts the major incident will receive a direct message from AI Incident Assistant requesting approval prior to posting actions.

Click Create Action to save the action.

You can edit or delete any existing action. In the actions timeline, click the Pencil icon to edit an action, or the Trash Can icon to delete it.

In this section: