AgentsIQ
Incident Response ▾
Agentic Pipeline Concept Agent Pipeline Overview Pipeline Monitor (Mockup) Functional Specification Future Work Tracker

AgentsIQ — Agent Pipeline

Three-agent autonomous incident detection, investigation and resolution system.
For internal brainstorming — AgentsIQ Engineering, Internal Platforms.

AgentsIQ agent pipeline Three agents in sequence: Alert Analyser, RCA Agent, Action Agent, connected by a shared RAG knowledge base feedback loop. OpsGenie / JSM raw alerts Alert Analyser Deduplicate · bucket · classify genuine / noise / suspect Enrich with inventory · RAG context lookup Noise ↑ MTTD improved — faster detection & triage genuine alerts + enriched context RCA Agent Investigate · identify root cause · recommend actions Build findings RAG · feed back to Alert Analyser ↑ MTTA improved — faster acknowledgement & response findings + recommended actions Action Agent Trigger Jenkins jobs · apply fix · verify resolution Feed results back to Alert + RCA agents Jira ticket No action mapped no fix Jenkins job Automated fix fix available ↑ MTTR improved — automated resolution or tracked escalation Shared RAG knowledge base Alert patterns · RCA findings · action outcomes Grows smarter with every incident Continuous improvement loop RAG feedback Alert / action flow

What this solves

Today, when an alert fires, multiple engineers are pulled in to triage, investigate, and fix — often spending hours on incidents that follow known patterns. This pipeline automates that entire chain, reserving human attention for genuinely novel problems.

MTTD
Mean time to detect
Alert Analyser reduces noise, surfaces real incidents faster
MTTA
Mean time to acknowledge
RCA Agent starts investigation instantly, no human triage needed
MTTR
Mean time to resolve
Action Agent applies known fixes automatically via Jenkins

The three agents

Agent 1

Alert Analyser

Reads alerts from OpsGenie / JSM and classifies them before any human sees them.

  • Deduplicates alerts — the same incident fired by multiple tools counts once
  • Classifies each alert as genuine, noise, or suspect using rule-based scoring
  • Enriches genuine alerts with inventory context (Customer, Application, Environment)
  • Looks up the RAG for known patterns matching this alert signature
  • Passes enriched genuine alerts downstream to the RCA Agent
Agent 2

RCA Agent

Receives genuine alerts and investigates to find the root cause.

  • Checks RAG for previous occurrences of the same or similar incident
  • Investigates logs, metrics, and service dependencies autonomously
  • Identifies root cause and generates a structured finding
  • Recommends specific remediation actions mapped to known fixes
  • Writes findings back to RAG so future incidents benefit from this analysis
  • Feeds findings and recommended actions to the Action Agent
Agent 3

Action Agent

Receives RCA findings and takes remediation action.

  • Checks if a Jenkins job exists for the recommended action
  • If yes — triggers the job, monitors execution, verifies resolution
  • If no — creates a Jira ticket with full context for the on-call engineer
  • Records outcome (success/failure, time taken) back to RAG
  • Feeds results back to Alert Analyser and RCA Agent to improve future classification

The shared RAG knowledge base

All three agents read from and write to a shared RAG store. This is what makes the system improve over time rather than repeating the same work on every incident.

What gets stored

Over time, the Alert Analyser stops escalating known-noise patterns. The RCA Agent skips investigation for known root causes. The Action Agent builds a larger library of automated fixes. The system matures towards full autonomous incident response.

Data flow — step by step

1

Alert fires in OpsGenie

New Relic, Zabbix, LightStep, or another monitoring tool sends an alert to OpsGenie. OpsGenie records it.

↓
2

Alert Analyser syncs and classifies

On the next sync cycle, Alert Analyser reads new alerts from OpsGenie. It deduplicates (same alias = same incident), scores each alert, and classifies it. Noise goes nowhere. Suspect gets flagged for human review. Genuine alerts are enriched with inventory data and RAG context.

↓
3

RCA Agent investigates

Alert Analyser passes enriched genuine alerts to RCA Agent. RCA checks the RAG first — if this pattern has been seen before, it applies the known root cause directly. Otherwise it investigates: pulling logs, checking dependent services, correlating with recent deployments. It produces a structured finding with recommended remediation actions.

↓
4

Action Agent remediates

RCA findings arrive at the Action Agent. It checks whether a Jenkins job exists for the recommended action. If yes, it triggers the job, watches the execution, and verifies the alert clears in OpsGenie. If no job is mapped, it creates a Jira ticket with the full RCA context attached so the on-call engineer has everything they need.

↓
5

Outcome feeds back to RAG

Regardless of whether the fix was automated or manual, the outcome is written to the shared RAG. Next time a similar alert fires, the whole chain is faster — Alert Analyser recognises the pattern, RCA skips investigation, Action Agent knows exactly which job to trigger.

Open questions for brainstorming

AreaQuestion
Alert Analyser → RCAWhat is the exact data contract? Which fields does RCA need from Alert Analyser?
RCA AgentWhich data sources can RCA query autonomously? Logs, metrics, traces, deployment history?
Action AgentHow is the Jenkins job catalogue maintained? Who maps alert types to jobs?
Action AgentWhat approval gates exist before automated actions execute on production?
RAGHow is the RAG structured? Per-service, per-alert-type, or a single global store?
RAGHow do we prevent bad fixes from being learned and re-applied?
Jira fallbackWhen a Jira is created and resolved manually, how does that fix get added to the Jenkins catalogue?
GovernanceWhich alert severities are allowed to trigger automated remediation without human approval?
ObservabilityHow do we track agent decisions end-to-end for audit and debugging?
AgentsIQ — Internal Platforms · Generated for brainstorming purposes · Not for external distribution