Skip to main content

Configuration

All tunable behaviour for Problem and Major Incident Detection lives in one place: GenAI Settings → Problem and Major Incident Detection. A tenant admin sets thresholds, customises the RCA template, tunes the batch cadence, and overrides the auto-tuned similarity threshold if needed.

Cluster formation thresholds​

Two numbers control whether a new cluster is formed:

SettingDefaultWhat it means
Minimum cluster size4Number of semantically-similar incidents required to form a cluster
Time window4 hoursThe window over which those incidents must be counted

A tenant with very high incident volume will usually raise the minimum size and shrink the window. A tenant with low volume but high tolerance for false alarms can lower the size to catch smaller patterns earlier.

Lifecycle thresholds​

The four lifecycle transitions described on the Incident clustering page are all configurable:

TransitionDefault ruleEditable parameter
Emerging → ActiveGrowth rate > 1 incident per hourGrowth-rate threshold
Active → HyperCareManual (agent action after fix applied)Whether to require manual HyperCare or allow automatic on cluster size plateau
HyperCare → Resolved24 hours with no new incidentsHours of quiet to require before auto-resolve
Emerging → StaleGrowth rate falls to zero before reaching ActiveTime before a quiet Emerging cluster is moved to Stale

Similarity threshold​

The AI auto-tunes the per-tenant similarity threshold from the feedback loop - the ratio of Reported to Dismissed clusters. Most tenants leave the auto-tune on. Tenants who want explicit control can override:

  • Manual threshold - a fixed similarity score (0.00 to 1.00); higher means stricter matching, smaller clusters, fewer false alarms.
  • Bias - keep auto-tune on but bias toward stricter or looser matching by a fixed offset.

The dashboard precision metric is the single best signal for whether the current threshold is too loose (low precision, lots of dismissals) or too tight (low recall, agents reporting clusters manually that the engine didn't catch).

RCA template​

The RCA template described under Pre-populated RCA template ships with sensible defaults, but tenants can:

  • Add fields - any field type supported by the ticket template engine (text, single-select, multi-select, date, user-picker, attachment)
  • Reorder fields
  • Mark fields required
  • Mark fields auto-populated vs blank for human entry
  • Hide fields the tenant doesn't use

A common tenant-specific addition is a Change Reference field that links the Problem to the Change Request that introduced the underlying defect.

Batch analysis cadence​

The periodic batch analysis that feeds Problem Candidates runs on a schedule:

  • Default: daily, overnight
  • Maximum: once per hour
  • Minimum: weekly

Most tenants keep daily. Raising to hourly is useful only for tenants with very high incident volume and many slow-burning patterns.

Notification routing​

The two broadcast notifications (queue broadcast and ticket-level broadcast described on the Alerts and reporting page) can be muted globally or per Major Incident severity. Common configurations:

  • Mute queue broadcast for P3 MIs (only P1/P2 should interrupt)
  • Always send ticket-level broadcast (agents need to know about their own tickets)

Workflows that need MI Commander approval​

The Report as Major Incident action can be configured to require MI Commander sign-off before the MI is declared. With approval enabled:

  1. The Service Desk Agent fills the draft and submits for review.
  2. The MI Commander gets a queued review item.
  3. On approval, the broadcasts go out.

With approval disabled, the broadcasts go out as soon as the agent publishes.

KEDB defaults​

  • Restricted to Agent flag is on by default for new KEDB entries (described under What's in the KEDB). Tenants who want some Known Errors to surface to end users via the self-service portal can override per-entry.
  • Auto-prompt on Problem resolution is on by default. Tenants who want manual KEDB curation only can turn it off.