An enterprise-grade AI pipeline that automatically triages IT incidents in ServiceNow — classifying, routing, and resolving them using GPT-4o-mini, with semantic KB retrieval via Azure AI Search and document extraction via Azure Document Intelligence.
Most IT operations teams handle incidents reactively — a ticket comes in, a technician reads it, figures out what it is, checks the knowledge base, and writes a response. This process is slow, inconsistent, and entirely dependent on individual knowledge.
This project replaces that manual triage layer with an AI pipeline that runs automatically. When a new incident arrives in ServiceNow, the pipeline classifies it, traverses the CMDB to understand what business service is impacted, reads any attached documents, finds the most semantically relevant KB article using vector search, and writes a structured work note back to the incident — all before a technician touches it.
What makes it different from a simple chatbot wrapper is the depth of integration: live taxonomy from ServiceNow, CMDB-aware routing, semantic vector KB retrieval, document extraction from attachments, and a self-improving knowledge base that learns from every resolved incident.
🚀 AIOps Pipeline starting...
Azure AI Search configured: True
Found 30 incident(s) to process
Processing INC0010038: Slow query alert — stored procedure sp_account_bal
Source: monitoring_tool
Category: database / db_query_perf (high)
CI: PROD-PAY-DB-01 → Database Administration
Found 3 attachment(s) — extracting text...
Extracted 1855 chars from INC0010038_DBA_Investigation.docx
Extracted 1168 chars from INC0010038_Dynatrace_Alert_Export.docx
Extracted 1943 chars from INC0010038_Post_Incident_Review.docx
Attachments: 3016 chars extracted
Related: 0 same CI, 1 same category
KB mode: semantic (Azure AI Search)
KB: Database Connection Pool Exhaustion (KB0010012)
✅ Work note written to ServiceNow
📧 Alert email sent to team
✅ Done — 1,685 tokens used
Work note written to ServiceNow — enriched with attachment content:
AI ANALYSIS — INC0010038 - CONFIDENCE: High
CATEGORY: Database / Query Performance
CI: PROD-PAY-DB-01
SERVICE: Payment Processing - PROD
CSDM: Payment Processing App → Payment Processing - PROD → PROD-PAY-DB-01
KB MATCH: Yes (KB0010012 — Database Connection Pool Exhaustion)
RELATED INCIDENTS:
• INC0010035 — Connection pool at 100% on PROD-PAY-DB-01
LIKELY CAUSE: The Q3 schema migration on 08-Apr-2026 invalidated the execution
plan for sp_account_balance_calc, causing a full table scan at 4.2s average,
while concurrent connection pool exhaustion (DT-ALERT-88421) exacerbated the
slowdown.
ACTIONS (From KB):
• Review execution plan for sp_account_balance_calc on PROD-PAY-DB-01
• Revert execution plan or create new index on account_transactions table
• Monitor connection pool utilisation — currently at 78%
• Analyse long-running transactions during peak hours
• Document findings for future reference
ESCALATION GROUP: Database Administration
NOTE: AI-generated. Validate before execution.
┌─────────────────────────────────────────────────────────────┐
│ ServiceNow PDI │
│ Incidents · CMDB · KB Articles · Attachments · Users │
└──────────────────────┬──────────────────────────────────────┘
│ REST API
▼
┌─────────────────────────────────────────────────────────────┐
│ AIOps Pipeline │
│ │
│ fetch_incidents → source_detector → classifier │
│ │ │
│ cmdb_lookup ───────────────┘ │
│ │ │
│ attachment_reader (Azure Doc Intelligence) │
│ │ │
│ similar_incidents (4 correlation signals) │
│ │ │
│ semantic_kb_search (Azure AI Search + GPT) │
│ │ │
│ work_note_generator (GPT-4o-mini) │
│ │ │
│ ┌──────────┴──────────┐ │
│ ▼ ▼ │
│ write_notes emailer │
│ (ServiceNow PATCH) (Gmail SMTP alert) │
│ │ │
│ logger │
│ (pipeline_log.jsonl) │
└─────────────────────────────────────────────────────────────┘
Weekly:
learning_loop → kb_proposer → email_proposals
│
Manager replies via email
│
email_listener (GPT parses reply)
│
┌───────────────┘
▼
Create/update KB in ServiceNow
| Component | Technology |
|---|---|
| AI model | OpenAI GPT-4o-mini (direct API, temperature: 0) |
| Embeddings | OpenAI text-embedding-ada-002 |
| Vector search | Azure AI Search (hybrid vector + keyword) |
| Document extraction | Azure Document Intelligence (prebuilt-read) |
| ITSM platform | ServiceNow (PDI) |
| Gmail SMTP + IMAP | |
| Dashboard | Streamlit |
| Language | Python 3.13 |
| KB drafts | python-docx |
AIOps Project/
├── pipeline/
│ ├── pipeline.py # Main orchestrator
│ ├── fetch_incidents.py # ServiceNow incident retrieval
│ ├── source_detector.py # Monitoring tool vs human detection
│ ├── classifier.py # AI classification — live ServiceNow taxonomy
│ ├── cmdb_lookup.py # CMDB chain traversal (CI → Service → App)
│ ├── attachment_reader.py # Azure Document Intelligence extraction
│ ├── similar_incidents.py # 4-signal incident correlation
│ ├── semantic_kb_search.py # Azure AI Search + GPT hybrid KB retrieval
│ ├── kb_retrieval.py # Fallback KB retrieval (no Azure)
│ ├── work_note_generator.py # Structured work note via GPT-4o-mini
│ ├── write_notes.py # ServiceNow PATCH operations
│ ├── logger.py # JSONL audit logging
│ ├── emailer.py # Incident alert emails
│ ├── config.py # Environment variable loading
│ ├── llm_client.py # OpenAI API client with retry logic
│ ├── snow_helpers.py # ServiceNow utility functions
│ ├── create_search_index.py # Azure AI Search index creation
│ ├── index_kb.py # KB article embedding and upload
│ ├── learning_loop.py # Weekly KB gap analysis
│ ├── kb_proposer.py # Word document generation
│ ├── email_proposals.py # KB proposal emails to manager
│ ├── email_listener.py # Manager reply processing
│ └── weekly_run.py # Weekly cycle entry point
├── prompts/
│ └── v1_work_note.txt # Work note generation prompt
├── dashboard/
│ └── dashboard.py # Streamlit analytics dashboard
├── tests/
│ └── eval_classifier.py # Classifier accuracy evaluation
├── logs/
│ ├── pipeline_log.jsonl # Full audit log
│ └── kb_proposals.jsonl # Weekly KB proposals
├── docs/
│ └── architecture.md # Architecture diagram (Mermaid)
├── .env.example # Environment variable template
├── requirements.txt # Python dependencies
└── README.md
- Python 3.11+
- ServiceNow Developer Instance (free)
- OpenAI API account
- Gmail account with App Password enabled
- Azure account — AI Search (Free F0) + Document Intelligence (Free F0)
git clone https://github.com/jijo09/AIOPs-Project.git
cd aiops-incident-intelligence
python -m venv venv
venv\Scripts\activate # Windows
# source venv/bin/activate # macOS/Linux
pip install -r requirements.txtCopy .env.example to .env and configure:
# ServiceNow
SNOW_INSTANCE=https://devXXXXXX.service-now.com
SNOW_USER=your.username
SNOW_PASS=your.password
# OpenAI
OPENAI_API_KEY=sk-...
# Gmail
EMAIL_FROM=[email protected]
EMAIL_APP_PASS=xxxx-xxxx-xxxx-xxxx
# Azure AI Search
SEARCH_ENDPOINT=https://your-search.search.windows.net
SEARCH_KEY=your-search-key
# Azure Document Intelligence
DOC_INTEL_ENDPOINT=https://your-doc-intel.cognitiveservices.azure.com
DOC_INTEL_KEY=your-doc-intel-keyRun once to create the vector index and upload KB article embeddings:
python pipeline/create_search_index.py
python pipeline/index_kb.py# Process all new incidents
python -m pipeline.pipeline
# Weekly KB learning cycle
python -m pipeline.weekly_run
# Process manager replies to KB proposals
python -m pipeline.email_listener
# Launch analytics dashboard
python -m streamlit run dashboard/dashboard.py
# Evaluate classifier accuracy
python -m tests.eval_classifier
# Test attachment extraction
python -m pipeline.attachment_reader| File | Purpose |
|---|---|
fetch_incidents.py |
Pulls New/In-Progress incidents from ServiceNow via REST API |
source_detector.py |
Detects monitoring tool vs human-submitted incidents |
classifier.py |
Fetches live category/subcategory from ServiceNow sys_choice table at runtime. GPT-4o-mini selects the closest match — no hardcoded taxonomy |
cmdb_lookup.py |
Traverses cmdb_rel_ci to build the full CSDM chain — CI → Service Instance → Business Application → Support Group |
attachment_reader.py |
Downloads incident attachments from ServiceNow, sends to Azure Document Intelligence prebuilt-read model, returns extracted plain text |
similar_incidents.py |
Four-signal correlation: same CI (alert dedup), CMDB neighbours, same service instance, 30-minute time window. GPT assesses genuine vs coincidental |
semantic_kb_search.py |
Azure AI Search vector query narrows to top 3 candidates by category, GPT re-ranks and picks the best match |
work_note_generator.py |
Builds structured work note using classification, CMDB chain, KB content, related incidents, and attachment text |
write_notes.py |
PATCHes ServiceNow incident with work note, category, subcategory, AI suggestion status |
emailer.py |
Sends alert email to L1 team via Gmail SMTP |
logger.py |
Appends JSONL entry to pipeline_log.jsonl for every incident processed |
Dynamic taxonomy — no hardcoded categories Categories and subcategories are fetched live from ServiceNow's sys_choice table at runtime. Adding a new category in ServiceNow is automatically reflected on the next run.
Hybrid semantic KB retrieval Azure AI Search performs vector similarity search filtered by category, returning the top 3 candidates. GPT-4o-mini then picks the best match from those 3. This combines the scalability of vector search with the accuracy of language model re-ranking.
Attachment-enriched work notes Azure Document Intelligence reads any files attached to the incident — investigation reports, monitoring exports, screenshots — and extracts their text. The AI work note references specific findings from the attachments, such as exact execution times, error codes, and alert IDs.
CMDB traversal by class, not relationship type cmdb_lookup.py identifies parent CIs as Service Instances or Business Applications by checking sys_class_name against known class sets — robust to how individual admins set up CMDB relationships.
Infrastructure-aware incident correlation similar_incidents.py uses four signals: same CI (alert deduplication across monitoring tools), CMDB relationship neighbours (switch down → servers affected), same service instance, and 30-minute time window. GPT determines which candidates are genuinely related.
Self-building KB The weekly learning loop identifies resolved incidents with no KB coverage, drafts articles from resolution notes, emails to manager for approval, and publishes on approval. The KB grows from real resolutions automatically.
Soft failures everywhere Every external call is wrapped in try/except with graceful degradation. A failure on one incident never stops the pipeline.
Evaluated against 22 real-world IT incident descriptions:
| Metric | Score |
|---|---|
| Category accuracy | 100% (22/22) |
| Subcategory accuracy | 91% (20/22) |
| Temperature | 0 — deterministic |
| Phase | Status | Description |
|---|---|---|
| Phase 1 | ✅ Complete | ServiceNow PDI, CMDB data model, 26 KB articles, 31 test incidents |
| Phase 2 | ✅ Complete | Core AI pipeline — classify, route, CMDB traversal, KB retrieval, work notes |
| Phase 3 | ✅ Complete | Human-in-the-loop — alerts, Streamlit dashboard, self-building KB |
| Phase 4 | ✅ Complete | Portfolio polish — documentation, README, architecture diagram |
| Phase 5 | ✅ Complete | Azure AI Search — semantic vector KB retrieval with GPT re-ranking |
| Phase 6 | ✅ Complete | Azure Document Intelligence — attachment text extraction enriches work notes |
Jijo Abraham — Technical Systems Analyst at CIBC transitioning into AI engineering.
This project demonstrates practical application of:
- Enterprise ITSM integration via REST API
- Retrieval-Augmented Generation (RAG) for IT knowledge management
- Semantic vector search with hybrid re-ranking
- Human-in-the-Loop AI governance
- CMDB-aware routing using ServiceNow CSDM
- Unstructured document extraction with Azure Document Intelligence
- Self-improving systems through automated feedback loops
Built entirely outside any employer environment using no company data.