	In Browser
	StumbleUpon
	del.icio.us
	Google
	Google Buzz
	reddit
	LinkedIn

	Facebook
	Twitter
	Linkedin
	E-Mail

Generative AI > Google Gemini API > Incident Triage Agent

Incident Triage Agent

Author: Venkata Sudhakar

ShopMax India's IT helpdesk receives hundreds of incident tickets daily across categories like network outages, payment gateway failures, warehouse system errors, and employee laptop issues. Manual triage is slow and inconsistent. An intelligent triage agent can classify, prioritise, and route each incident in seconds.

This tutorial builds a Gemini ADK agent that classifies an incoming incident by category and impact, assigns a severity level (P1 to P4), determines SLA response time, and routes the ticket to the correct team with a brief action recommendation.

The below example shows an IT incident triage agent for ShopMax India in a business context.

import asyncio
from google.adk.agents import LlmAgent
from google.adk.tools import FunctionTool
from google.adk.runners import Runner
from google.adk.sessions import InMemorySessionService
from google.genai import types

# Routing rules by keyword -> team
ROUTING = {
    "payment": "Payments Engineering",
    "checkout": "Payments Engineering",
    "website": "Platform Engineering",
    "app": "Platform Engineering",
    "warehouse": "WMS Team",
    "inventory": "WMS Team",
    "vpn": "Network & Security",
    "network": "Network & Security",
    "laptop": "IT Helpdesk",
    "email": "IT Helpdesk",
    "printer": "IT Helpdesk",
}

# Impact -> severity mapping
SEVERITY_MAP = {
    "all customers": "P1",
    "revenue impacted": "P1",
    "multiple users": "P2",
    "single user": "P3",
    "cosmetic": "P4",
}

SLA_HOURS = {"P1": 1, "P2": 4, "P3": 8, "P4": 24}

def triage_incident(title: str, description: str, reported_by: str) -> dict:
    desc_lower = description.lower()
    title_lower = title.lower()
    combined = desc_lower + " " + title_lower
    # Determine team
    assigned_team = "General IT Helpdesk"
    for keyword, team in ROUTING.items():
        if keyword in combined:
            assigned_team = team
            break
    # Determine severity
    severity = "P3"
    for phrase, sev in SEVERITY_MAP.items():
        if phrase in combined:
            severity = sev
            break
    sla = SLA_HOURS[severity]
    actions = {
        "P1": "CRITICAL - Page on-call engineer immediately. Initiate war room.",
        "P2": "HIGH - Notify team lead. Assign engineer within 30 minutes.",
        "P3": "MEDIUM - Assign to next available engineer in queue.",
        "P4": "LOW - Log and schedule for next business day.",
    }
    return {
        "ticket_title": title,
        "reported_by": reported_by,
        "severity": severity,
        "assigned_team": assigned_team,
        "sla_response_hours": sla,
        "recommended_action": actions[severity],
    }

triage_tool = FunctionTool(func=triage_incident)

agent = LlmAgent(
    name="incident_triage_agent",
    model="gemini-2.0-flash",
    description="Triages IT incidents for ShopMax India, classifying severity and routing to the right team.",
    instruction=(
        "You are an IT incident triage agent for ShopMax India. "
        "When an incident is reported, call triage_incident with the title, description, and reporter. "
        "Present the severity classification, assigned team, SLA, and recommended immediate action clearly."
    ),
    tools=[triage_tool],
)

async def main():
    session_service = InMemorySessionService()
    runner = Runner(agent=agent, app_name="triage_app", session_service=session_service)
    session = await session_service.create_session(app_name="triage_app", user_id="helpdesk1")
    msg = types.Content(role="user", parts=[types.Part(
        text=(
            "New incident: Title: Payment checkout failing for all customers. "
            "Description: All customers are getting errors at checkout. Revenue impacted. "
            "Reported by: Ops Team Mumbai"
        )
    )])
    async for event in runner.run_async(user_id="helpdesk1", session_id=session.id, new_message=msg):
        if event.is_final_response() and event.content:
            print(event.content.parts[0].text)

asyncio.run(main())

It gives the following output,

Incident Triage Result - ShopMax India IT

Ticket  : Payment checkout failing for all customers
Reporter: Ops Team Mumbai

Severity        : P1 (CRITICAL)
Assigned Team   : Payments Engineering
SLA Response    : Within 1 hour

Recommended Action:
  CRITICAL - Page on-call engineer immediately. Initiate war room.

This is a P1 incident affecting all customers with direct revenue impact.
Escalate to Payments Engineering lead and CTO if not resolved in 30 minutes.

ShopMax India can integrate this agent with its ITSM platform (Jira Service Management or Freshservice) so that every new ticket automatically triggers triage before a human sees it. P1 incidents immediately page the on-call engineer via PagerDuty, while P4 tickets are batched for the next working day, dramatically reducing mean time to resolution for critical issues.

Send your comments, suggestions or queries regarding this site to [email protected].