IT ops anomaly / incident triage
A use case in any organisation, seen as a chain of named AI tasks.
What it is. IT ops anomaly / incident triage is an AI use case in any organisation. Its input is a time series, and underneath it is a short chain of named tasks: it flags what does not fit the usual pattern, then sorts each case into a category, then summarises it. That makes it an agent: several tasks with a generative step are usually built as an agent, which runs the steps in a loop, uses tools, and decides what to do next.
How you tell it is working. Each task is measured, and fails, differently. The weakest step sets the ceiling for the whole chain, so concentrate testing there.
- Detect anomalies (pattern discovery): how many real oddities it catches without crying wolf too often. Watch: accuracy is misleading on rare events.
- Classify (prediction): how often it is right, and how many real cases it catches. Watch: accuracy lies when one class dominates.
- Summarise (language): whether it keeps the key points and a person finds it faithful. Watch: omission and invented facts.
How much it decides. As drawn, it sits at the agent level: plans, uses tools, and acts in a loop; it does things. The same use case can be built with more or less autonomy, and more autonomy means more reach and more to check.
Judging the materiality. This page does not assign a risk tier. How material it is depends on your deployment: who it affects, whether a person genuinely re-decides or only approves, whether the action can be reversed, and your regulatory and fairness exposure. Rate it on impact, complexity and reliance as the AIRG expects, and let the controls follow. See use-case risk and materiality.
Related: the interactive AI use-case explorer, AI use cases by industry, and the AI risks taxonomy.