<style> .chartjs-size-monitor { display: none !important; height: 0 !important; overflow: hidden !important; }p { margin: 0; }span.fr-emoticon.fr-emoticon-img { background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle; } span.fr-emoticon { font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0; } blockquote { border-left: solid 2px #5e35b1; color: #5e35b1; margin-left:0; padding-left:5px;}blockquote blockquote{ border-color: #00bcd4; color: #00bcd4;}blockquote blockquote blockquote{ border-color: #43a047; color: #43a047;} table.grid{ border-collapse: collapse;} table.grid td, table.grid th { border: 1px solid #ddd;} .fr-fic.fr-dib{ display: block; margin: 5px auto;}.fr-fic.fr-dib.fr-fir{ text-align: right; margin: 5px 0 5px auto;}.fr-fic.fr-dib.fr-fil{ text-align: left; margin: 5px auto 5px 0;}.fr-fic.fr-dii{ float: none; margin: 5px auto;}.fr-fic.fr-dii.fr-fil{ float: left; margin: 5px auto;}.fr-fic.fr-dii.fr-fir{ float: right; margin: 5px auto;}img.fr-dib.fr-fir { margin-right: 0; text-align: right;}img.fr-dib.fr-fil { margin-left: 0; text-align: left;}img.fr-dib { margin: 5px auto; display: block; float: none;}img.fr-bordered { box-sizing: content-box; border: solid 5px #CCC;}img.fr-shadow { box-shadow: 10px 10px 5px 0px #cccccc;}img.fr-rounded { border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;}</style><style>
.chartjs-size-monitor {
display: none !important; height: 0 !important; overflow: hidden !important;
}
p {
margin: 0;
}
span.fr-emoticon.fr-emoticon-img {
background-repeat: no-repeat !important; font-size: inherit; height: 1em; width: 1em; min-height: 20px; min-width: 20px; display: inline-block; margin: -0.1em 0.1em 0.1em; line-height: 1; vertical-align: middle;
}
span.fr-emoticon {
font-weight: normal; font-family: "Apple Color Emoji", "Segoe UI Emoji", "NotoColorEmoji", "Segoe UI Symbol", "Android Emoji", "EmojiSymbols"; display: inline; line-height: 0;
}
blockquote {
border-left: solid 2px #5e35b1; color: #5e35b1; margin-left: 0; padding-left: 5px;
}
blockquote blockquote {
border-color: #00bcd4; color: #00bcd4;
}
blockquote blockquote blockquote {
border-color: #43a047; color: #43a047;
}
table.grid {
border-collapse: collapse;
}
table.grid td,
table.grid th {
border: 1px solid #ddd;
}
.fr-fic.fr-dib {
display: block; margin: 5px auto;
}
.fr-fic.fr-dib.fr-fir {
text-align: right; margin: 5px 0 5px auto;
}
.fr-fic.fr-dib.fr-fil {
text-align: left; margin: 5px auto 5px 0;
}
.fr-fic.fr-dii {
float: none; margin: 5px auto;
}
.fr-fic.fr-dii.fr-fil {
float: left; margin: 5px auto;
}
.fr-fic.fr-dii.fr-fir {
float: right; margin: 5px auto;
}
img.fr-dib.fr-fir {
margin-right: 0; text-align: right;
}
img.fr-dib.fr-fil {
margin-left: 0; text-align: left;
}
img.fr-dib {
margin: 5px auto; display: block; float: none;
}
img.fr-bordered {
box-sizing: content-box; border: solid 5px #CCC;
}
img.fr-shadow {
box-shadow: 10px 10px 5px 0px #cccccc;
}
img.fr-rounded {
border-radius: 10px; -moz-border-radius: 10px; -webkit-border-radius: 10px; -moz-background-clip: padding; -webkit-background-clip: padding-box; background-clip: padding-box;
}
</style><p data-pasted="true"><span style="font-size: 11pt;"><strong>In this guide we will cover:</strong></span></p><p><span style="font-size: 11pt;"><strong>- What Is Halo's AI Major Incident Detection?</strong></span></p><p><span style="font-size: 11pt;"><strong>- </strong></span><span style="font-size: 11pt;"><a href="#how-does-it-work"><strong>How Does It Work?</strong></a></span></p><p><span style="font-size: 11pt;"><strong>- </strong></span><span style="font-size: 11pt;"><a href="#setup-MI"><strong>Setting Up AI Major Incident Detection</strong></a></span></p><p style="margin-left: 20px;"><span style="font-size: 11pt;"><strong>- Creating The Process Agent</strong></span></p><p style="margin-left: 20px;"><span style="font-size: 11pt;"><strong>- Creating The Runbook</strong></span></p><p><span style="font-size: 11pt;"><strong><br></strong></span></p><p><span style="font-size: 11pt;"><strong>Related Guides</strong></span></p><ul><li style="font-size: 11pt; font-weight: bold;"><strong><a href="https://www.usehalo.com/guides/2783" target="_blank" rel="noopener noreferrer" style="font-size: 11pt; font-weight: bold;">Process Agents</a></strong></li><li style="font-size: 11pt; font-weight: bold;"><a href="https://www.usehalo.com/guides/1630" target="_blank" rel="noopener noreferrer" style="font-size: 11pt; font-weight: bold;"><strong>Custom Integrations/Runbooks</strong></a></li></ul><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 14pt;"><strong>What Is Halo's AI Major Incident Detection?</strong></span></p><p><span style="font-size: 11pt;">Whenever a new incident Ticket is raised in the system, an evaluation is carried out on its related <a href="https://www.usehalo.com/guides/2794" target="_blank" rel="noopener noreferrer">Ticket Cluster</a> to check whether that Cluster is 'surging'. </span></p><p><span style="font-size: 11pt;">If it is determined that a 'surge' is occurring, intelligent analysis is carried out on that Ticket and its Cluster by a <a href="https://www.usehalo.com/guides/2783" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">Process Agent</a> to determine whether a Major Incident should be declared. If the outcome of this analysis is yes, then the Agent will create a major incident Ticket and link the effected Tickets to it. </span></p><p><span style="font-size: 11pt;"><br></span></p><p data-pasted="true"><span style="font-size: 11pt;">If you have a HaloITSM environment that was deployed <strong>after </strong>August 28th 2026, then this process will be pre-built in your system and ready to use without further configuration. </span></p><p><span style="font-size: 11pt;">If you have a HaloITSM environment that was deployed <strong>before </strong>this date, <strong>or </strong>if you have an instance of another Halo product (PSA, CRM, CSM), then you will need to set up the process using the "Setting Up AI Major Incident Detection" section of this guide.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong>Important:</strong> Ticket Clustering must be enabled and set up in order for this process to work. If you do not yet have Ticket Clustering set up in your environment, see the guide for configuration help: <a href="https://www.usehalo.com/guides/2794" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">AI Ticket Clustering</a>. </span></p><p><br></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 14pt;"><strong><a id="how-does-it-work" class="fr-anchor" title="how-does-it-work"></a>How Does It Work?</strong></span></p><p><span style="font-size: 11pt;">Every time a new incident is logged in the system, a Custom Integration Runbook is triggered called "Halo AI - Major Incident Detection". </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImUzNGUwMjVlLTRlZGYtNDY3NC05NDU0LTNkNWI5NzRlNTVjNCJ9.XSQNLnM1EJp7Qr2iVCz3G-mS5Ztg4L9uEEq3eqoxfFQ" width="794" style="width: 796px; height: 437.748px;" height="438" class="fr-fic fr-dii"></span></p><p><span style="font-size: 10pt;"><strong>Fig 1. The major incident detection runbook</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">The runbook checks for a 'surge' of Tickets, within the newly logged Ticket's related Cluster, by running a SQL query against the Cluster. A 'surge' will be flagged if one of the following is occurring within the Cluster: </span></p><ul><li style="font-size: 11pt;">The Cluster is less than 60 tickets large, and 3 or more of those Tickets were logged in the last ten minutes.</li><li style="font-size: 11pt;">The Cluster is 60 tickets or more, and 5% or more of those Tickets were logged in the last ten minutes.</li></ul><p><span style="font-size: 11pt;">As you can see in Figure 1, if a 'surge' is identified then the fourth step of the runbook will trigger a Process Agent to review the ticketing data for the surging Cluster and determine whether a Major Incident is necessary. </span></p><p><span style="font-size: 11pt;">If the Agent decides a Major Incident is necessary, it posts to the Ticket and creates the Major Incident Ticket. The Major Incident is then linked as a parent to the existing incidents by the runbook. </span></p><p><span style="font-size: 11pt;"><br></span></p><p data-pasted="true"><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Ijk2Y2I5NGM1LTJkY2QtNGMwMS1hZmFhLTEwMDcxOWJlYzgxOSJ9.SIhm2PAWQBSP_cGHozKhjOI_QNo0xw4uacHcdouP_R8" width="927" style="width: 929px; height: 623.532px;" height="624" class="fr-fic fr-dii"></span></p><p><span style="font-size: 10pt;"><strong>Fig 2. A major incident is created from a ticket indicating a 'surging' cluster</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 14pt;"><strong><a id="setup-MI" class="fr-anchor" title="setup-MI"></a>Setting Up AI Major Incident Detection</strong></span></p><p><span style="font-size: 11pt;">As mentioned in the introduction to this guide, if you have a HaloITSM environment that was deployed <strong>after </strong>August 28th 2026, then this process will be pre-built in your system and ready to use without further configuration. </span></p><p><span style="font-size: 11pt;">If you have a HaloITSM environment that was deployed <strong>before </strong>this date, <strong>or </strong>if you have an instance of another Halo product (PSA, CRM, CSM), then you will need to set up the process using this section of the guide.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">The AI Major Incident detection process is composed of a Custom Integration Runbook and a type of AI Agent called a 'Process Agent', foundational understanding of both these features is assumed. To learn more about either feature, see the dedicated guides: <a href="https://www.usehalo.com/guides/1630" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">Custom Integrations/Runbooks</a> & <a href="https://www.usehalo.com/guides/2783" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">Process Agents</a>.</span></p><p><span style="font-size: 11pt;">As the Process Agent is triggered by a step within the runbook, it is best to create the Process Agent first. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 12pt;"><strong>Creating The Process Agent</strong></span></p><p><span style="font-size: 11pt;"><strong><em>Note: This section assumes that you are creating this process manually (not by downloading the runbook from the online repository), or that you are on a version earlier than version 2.250. If you are operating on version 2.250 or later, then this AI agent will be automatically created and set up for you <u>if</u> downloading the runbook from the online repository.</em></strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">AI Agents in Halo require authorised API access provisioned via <a href="https://www.usehalo.com/guides/1823" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">API applications</a>. If you are operating on version 2.250 or later, then an API application will be created for you automatically when creating the Process Agent. However, if you are on a version prior to version 2.250, then an API application will need to be created before the Agent is created.</span></p><p><br></p><p><span style="font-size: 11pt;"><span style="font-size: 11pt;" data-pasted="true"><strong><em>Note: If you are downloading the "Halo AI - Agent Major Incident Detection" runbook from the online repository, then this creation of the Process Agent is not necessary, as the Agent will be created for you when the runbook is installed. However, once the Agent is installed via this method, you will need to set the ticket type and the report for the CF_Create_Major_Incident and CF_Get_Open_Major_Incidents functions respectively. See the "Functions" section of this guide for further insight.</em></strong></span></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong>API Application (Versions v2.250+)</strong></span></p><p><span style="font-size: 11pt;">On versions 2.250+, an Automation Identity API Application will be created for you automatically when creating a Process Agent, saving you the need to create an API Application yourself. Once the Agent is saved, a link to the created application will be available. </span></p><p><span style="font-size: 11pt;"><br></span></p><p data-pasted="true"><span style="font-size: 11pt;">The permissions the Automation Identity application has will be determined by the functions you enable for the Process Agent. E.g. adding the "Get One Ticket" function to the Agent automatically adds the "read:tickets" permission.</span></p><p><span style="font-size: 11pt;"><br></span></p><p data-pasted="true"><span style="font-size: 11pt;"><strong>API Application (Versions prior to v2.250+)</strong></span></p><p><span style="font-size: 11pt;">To create the Process Agent, you will first need to create an API Application to allow the Agent to connect to Halo. Head to Configuration > Integrations > Halo API, and click on the "View Applications" button. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImU0MjVkNWZjLWJjZjktNDFkNi1hMmJkLTM4YmE0MjA0ODljNCJ9.kCJ1oF1Bmu61QMFhSNxn90bxY2QikS1udz2nM1m8aWI" class="fr-fic fr-fil fr-dib" width="891" style="width: 893px; height: 533.17px;" height="533"></span></p><p data-pasted="true"><span style="font-size: 10pt;"><strong>Fig 3. The API Application configuration area</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p data-pasted="true"><span style="font-size: 11pt;">Click "+ New" to create a new API Application.</span></p><p data-pasted="true"><span style="font-size: 11pt;">Give this application a recognisable name and set the Authentication Method to "Halo Automation Identity". </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImFjZmIzZWJkLTY3ZWUtNDdkMy04M2ZlLWQwM2I2OTJmODcwMiJ9.zEGrAszIpC46MULTdgBONPzzQ-1BQZTxNmmaDa8U2TE" class="fr-fic fr-fil fr-dib" width="536" style="width: 538px; height: 490.481px;" height="490"></span></p><p data-pasted="true"><span style="font-size: 10pt;"><strong>Fig 4. Creating an API Application with Halo Automation Identity</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p data-pasted="true"><span style="font-size: 11pt;">Once selected, you will need to specify an identity for the application. This informs the base level of access granted to the application. The option "Application identity" is recommended here, as you can use <a href="https://www.usehalo.com/guides/882" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">roles </a>to control the base level of permission rather than having to pick a specific Agent. When this option is selected the "Identity Roles" field can be used to determine which roles to use as the base level permissions.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjcxYmY0MDY3LTg4ODAtNDFhOC1hY2M3LTgxNDcwYzdjNTZlZSJ9.5QGyVnGeZ4sqzXysLHQfa56xi_RCZOySTdoouoOvQyo" class="fr-fic fr-fil fr-dib" width="738" style="width: 740px; height: 189.427px;" height="189"></span></p><p data-pasted="true"><span style="font-size: 10pt;"><strong>Fig 5. API Application using Application identity </strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">You will then need to ensure that you set the correct permissions in the 'Permissions' tab of the application. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjJmZDY4ZTgxLTU0OGItNGIyZC1hYTkwLTQ5ZWEyYmFmMjBlZiJ9.icWvuikMPMPGVAaUdRUoLSaOcUdAXjzVHngf2nTteEA" class="fr-fic fr-fil fr-dib" width="807" style="width: 809px; height: 551.357px;" height="551"></span></p><p><span style="font-size: 10pt;"><strong>Fig 6. Setting the required permissions for the API application</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">These permissions should be based on what the Process Agent will be required to do. If you will be replicating the Major Incident Detection process without changes, then the recommended permissions are as follows:</span></p><ul><li style="font-size: 11pt;">read:tickets</li><li style="font-size: 11pt;">edit:tickets</li><li style="font-size: 11pt;">read:customers</li><li style="font-size: 11pt;">read:kb</li><li style="font-size: 11pt;">read:assets</li></ul><p><span style="font-size: 11pt;">Once the permissions for the application are set, save the application. The next stage will be to create the Process Agent that will use this API application.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong>Process Agent</strong><br></span></p><p><span style="font-size: 11pt;">A Process Agent is a specific type of AI Agent. Therefore, to create a new Process Agent, navigate to Configuration > AI > AI Agents. Select the "Process Agents" button and select the "+ New" button in the top right corner.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjE0M2QyZTU3LTYwZjAtNDhkMy05MzdhLTZjOGRhZDE4YmQwOSJ9.UCaYPVzv6kaq4jZpDdQ8gWL2Y5_uuITtUBFqewdTGGI" width="865" style="width: 867px; height: 601.685px;" height="602" class="fr-fic fr-dii"></span></p><p><span style="font-size: 10pt;"><strong>Fig 7. Navigating to the process agents configuration area</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong>Details & Configure Connection</strong></span></p><p><span style="font-size: 11pt;">Give the Process Agent a relevant name, and then configure both its AI connection and its Halo connection. The "Built-in OpenAI" connection can be used for the AI connection, but you can use your own connection if you would prefer. See our dedicated guide on AI connections for more information: <a href="https://www.usehalo.com/guides/2385" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">Connecting AI to Halo</a>.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">For the Halo connection, select the "Agent to log in as". Here, it is best practice to choose "Application Identity" and then choose "sys-all-permissions" for the "Identity Roles" option. </span></p><p><span style="font-size: 11pt;"><strong><em>Note: If you are on version 2.250 or later, then an API application will be created for this connection when the Process Agent is saved. If you are on a version prior to 2.250, then you will need to select your newly created API application as the "Halo Application to authorise as". </em></strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImIxYjhkOWMwLTQ3MGEtNDVmMi05MjNlLTA3ODY5M2M2MWI4YSJ9.gL_-AsgwgxBpxCR9hf5voa8B1VQ46c_1Rf8Sbcowucc" class="fr-fic fr-fil fr-dib" width="773" style="width: 775px; height: 509.942px;" height="510"></span></p><p><span style="font-size: 10pt;"><strong>Fig 8. Setting up the AI and Halo connections for the Process Agent</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong>Assistant Fields</strong></span></p><p><span style="font-size: 11pt;">For the Process Agent's instructions, if you would to like to use the same instructions that are used in pre-built environments, download the file attached to this article labelled "Major Incident Analyst instructions". If you are reading this guide on our website, you will need to <a href="https://support.haloservicedesk.com/portal/kb?btn=46&id=3010" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">view it on our support portal</a> in order to access the attachments. </span></p><p><span style="font-size: 11pt;">Copy all text within the file and paste it into the instructions field of the Process Agent. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">Please note that it is not necessary to enable the "Force JSON response" checkbox.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVlNDIyNTY2LTAyZGQtNDZhNy1iNmEyLWQxOTFiMTRjNGRmZSJ9.i37BtmHP9xveOhN8cAhLAHMbghfjjXBJG_ZDoOwXvAs" class="fr-fic fr-fil fr-dib" width="883" style="width: 885px; height: 317.833px;" height="318"></span></p><p><span style="font-size: 10pt;"><strong>Fig 9. Provide the instructions for the Process Agent</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">The instructions instruct the following:</span></p><ul><li style="font-size: 11pt;">Read the recent Tickets in the flagged Cluster and note each one’s affected service, summary, requester and time logged.</li><li style="font-size: 11pt;">Decide whether to declare a Major Incident, leaning towards declaring unless there are fewer than 3 Tickets or they are clearly unrelated.</li><li style="font-size: 11pt;">If not declaring, post a note on the triggering Ticket only, explaining why.</li><li style="font-size: 11pt;">Check the open Major Incidents from the last 7 days for one that matches the same problem, timeframe and failure domain.</li><li style="font-size: 11pt;">If a match is found, post an update note on that existing MI only, listing the new incoming Tickets.</li><li style="font-size: 11pt;">If no match is found, create a new MI using the set summary and description format, then post a note on every affected Ticket.</li><li style="font-size: 11pt;">Write all notes as a human MI manager would, using only the permitted HTML tags and no dashes or references to tools or automation.</li><li style="font-size: 11pt;">Finish with a single JSON reply listing each Ticket, its parent MI and the decision taken.</li></ul><p><span style="font-size: 11pt;"><br></span></p><p data-pasted="true"><span style="font-size: 11pt;">If you would like to customise your handover review process, these instructions are your main opportunity to do so. You may want to edit the instructions to tailor it towards your company's handover processes in order to make the review as beneficial and accurate as possible. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><em><strong>Note: If you create new instructions, ensure that the input variables are included for providing the AI model with the context of the Ticket, or that new variables are created to provide your chosen data. To learn more about creating input variables for Process Agents, see this guide: </strong></em><a href="https://www.usehalo.com/guides/2783" target="_blank" rel="noopener noreferrer"><em><strong>Process Agents</strong></em></a><em><strong>.</strong></em></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">You will notice that, in the instructions, both input variables (inputs) and functions (tools) are referenced. These need to be created in the Process Agent's configuration in order for them to be leveraged. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong>Input Variables</strong></span></p><p><span style="font-size: 11pt;">If using the provided instructions, you will need to create 7 input variables:</span></p><p><span style="font-size: 11pt;"> </span></p><table class="styled-table grid"><colgroup><col style="width: 20.8438%;"></colgroup><colgroup><col style="width: 16.7542%;"></colgroup> <colgroup><col style="width: 20.4547%;"></colgroup> <colgroup><col style="width: 41.9473%;"></colgroup><tbody><tr style="height: 47.4286px;"><td style="text-align: center; background-color: rgb(0, 204, 248);"><span style="font-size: 11pt;">Name</span></td><td style="text-align: left; background-color: rgb(0, 204, 248);"><div style="text-align: center;"><span style="font-size: 11pt;">Data Type</span></div></td><td style="text-align: center; background-color: rgb(0, 204, 248);"><span style="font-size: 11pt;">Mandatory</span></td><td style="text-align: center; background-color: rgb(0, 204, 248);"><span style="font-size: 11pt;">Description</span></td></tr><tr style="height: 35.4286px;"><td><span style="font-size: 11pt;">TriggeringTicketID</span></td><td><span style="font-size: 11pt;"> Number</span></td><td style="text-align: left;"><p data-pasted="true"><span style="font-size: 11pt;"> No</span></p></td><td style="text-align: left;"><span style="font-size: 11pt;">Set the parameter to the input Ticket ID</span></td></tr><tr style="height: 30px;"><td id="name"><span style="font-size: 11pt;">TriggeringTicketSummary</span></td><td><span style="font-size: 11pt;"> String</span></td><td style="text-align: left;"><p data-pasted="true"><span style="font-size: 11pt;"> Yes</span></p></td><td style="text-align: left;"><span style="font-size: 11pt;">Summary of the incoming ticket</span></td></tr><tr style="height: 30px;"><td id="note"><span style="font-size: 11pt;">ClusterID</span></td><td><span style="font-size: 11pt;"> Number</span></td><td style="text-align: left;"><p data-pasted="true"><span style="font-size: 11pt;"> No</span></p></td><td style="text-align: left;"><p data-pasted="true"><span style="font-size: 11pt;">The cluster ID the triggering ticket joined</span></p></td></tr><tr style="height: 30px;"><td><span style="font-size: 11pt;">ClusterName</span></td><td><span style="font-size: 11pt;"> String</span></td><td style="text-align: left;"><p data-pasted="true"><span style="font-size: 11pt;"> No</span></p></td><td style="text-align: left;"><span style="font-size: 11pt;">Name of the cluster/theme</span></td></tr><tr style="height: 39.4286px;"><td><p data-pasted="true"><span style="font-size: 11pt;">ClusterMemberCount</span></p></td><td><span style="font-size: 11pt;"> Number</span></td><td style="text-align: left;"><p data-pasted="true"><span style="font-size: 11pt;"> No</span></p></td><td style="text-align: left;"><span style="font-size: 11pt;">Total existing members in the cluster</span></td></tr><tr style="height: 30px;"><td><span style="font-size: 11pt;">RecentJoinCount</span></td><td><span style="font-size: 11pt;">Number</span></td><td style="text-align: left;"><span style="font-size: 11pt;">No</span></td><td style="text-align: left;"><span style="font-size: 11pt;">Count of tickets that joined this cluster in the last 10 minutes</span></td></tr><tr><td><span style="font-size: 11pt;">RecentTicketsJson</span></td><td><span style="font-size: 11pt;">String</span></td><td style="text-align: left;"><span style="font-size: 11pt;">No</span></td><td style="text-align: left;"><span style="font-size: 11pt;">JSON array of recent member tickets (faultid, summary, details, userid, user_name, service_id, dateoccured)</span></td></tr></tbody></table><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">These input variables are populated by the runbook step that triggers the Process Agent, and they are how the relevant data is provided to the AI model. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImVmNmZhMDljLWU1NjEtNDVjYi1iYmVmLTliYTg3MDkzODlmNSJ9.Zm3v8UdYM4u-Q5N2wH76r0_d14pdCi_wdXfCCAVPeZs" class="fr-fic fr-fil fr-dib" width="864" style="width: 866px; height: 428.745px;" height="429"></span></p><p><span style="font-size: 10pt;"><strong>Fig 10. Configure the input variables for the process agent</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong><em>Note: If you have created your own instructions, or customised the ones provided, then you should ensure that input variables are still specified in your instructions - either the provided ones or your own. For more information on input variables for Process Agents, see this guide: <a href="https://www.usehalo.com/guides/2783" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">Process Agents</a>.</em></strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong>Functions</strong></span></p><p><span style="font-size: 11pt;">The functions for a Process Agent are the way in which an Agent is able to carry out certain actions in your Halo, such as running reports or adding notes to Tickets. For more information on them, please see the guide: <a href="https://www.usehalo.com/guides/2783" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">Process Agents</a>.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">If you are using the pre-built instructions then this particular Agent does not require any system functions, but it does require 4 custom functions.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjMwZmM1Y2JjLWRhOTgtNDJkNi1hN2EyLTg4M2Q5ZDQwMDM2MyJ9.Mh4NsNovJSudCVeykbHIHIWjWr1Yr6Pk-zON33MKQ30" class="fr-fic fr-fil fr-dib" style="width: 924px; height: 338.017px;" width="1414" height="518"></span></p><p><span style="font-size: 10pt;"><strong>Fig 11. Create 4 custom functions for the Process Agent</strong></span></p><p><span style="font-size: 11pt;"> </span></p><table class="styled-table grid"><colgroup><col style="width: 37.482%;"></colgroup><colgroup><col style="width: 43.7698%;"></colgroup> <colgroup><col style="width: 18.7482%;"></colgroup><tbody><tr style="height: 48px;"><td style="text-align: left; background-color: rgb(0, 204, 248);"><span style="font-size: 11pt;"> Name</span></td><td style="text-align: center; background-color: rgb(0, 204, 248);"><span style="font-size: 11pt;"> Description </span></td><td style="text-align: center; background-color: rgb(0, 204, 248);"><span style="font-size: 11pt;">Use</span></td></tr><tr style="height: 35.8333px;"><td><span style="font-size: 11pt;">CF_Create_Major_Incident</span></td><td><span style="font-size: 11pt;">Use the function to create a Major Incident</span></td><td style="text-align: left;"><p data-pasted="true"><span style="font-size: 11pt;">Create new Ticket</span></p></td></tr><tr style="height: 30px;"><td id="name"><p><span style="font-size: 11pt;">CF_Get_Open_Major_Incidents</span></p></td><td><span style="font-size: 11pt;">Use this report to check open major incidents</span></td><td style="text-align: left;"><p data-pasted="true"><span style="font-size: 11pt;">Get Report Data</span></p></td></tr><tr style="height: 30px;"><td id="note"><span style="font-size: 11pt;">CF_Get_One_Ticket</span></td><td><span style="font-size: 11pt;">Use this function to get further detail on existing open tickets</span></td><td style="text-align: left;"><p data-pasted="true"><span style="font-size: 11pt;">Get One Ticket</span></p></td></tr><tr style="height: 30px;"><td><span style="font-size: 11pt;">CF_Add_Note_To_Ticket</span></td><td><span style="font-size: 11pt;">Use this function to add a note to a ticket</span></td><td style="text-align: left;"><p data-pasted="true"><span style="font-size: 11pt;">Add Note to Ticket</span></p></td></tr></tbody></table><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong><em>Note: The CF_Create_Major_Incident fuction should have the Incident ticket type set against it, and it should use the "Summary and Details" fields as parameters. </em></strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong><em>Note: The CF_Get_Open_Major_Incidents function should run the "Open Major Incidents" report. This will need to be downloaded from the reporting online repository to be able to select it for the function. For information on how to do this, see the guide: <a href="https://www.usehalo.com/guides/2425" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">Report Online Repository</a>.</em></strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">Once the functions have been fully configured, the Agent can be saved and you can move on to configuring the runbook. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 12pt;"><strong>Creating The Runbook</strong></span></p><p><span style="font-size: 11pt;">The runbook is the method by which the Process Agent is triggered and provided with the data for its analysis.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">To create the runbook, navigate to Configuration > Integrations > Custom Integrations > Integration Runbooks. From here, there are two creation methods to choose from. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong>Install From The Online Repository</strong></span></p><p><span style="font-size: 11pt;">As has been noted throughout this guide, on versions 2.250+ it is possible to download the runbook from the online repository and have that also install the Process Agent and API Application. To do this, select the globe icon in the top right corner to enter the online repository. Locate the "Halo AI - Agent Major Incident Detection", click into the runbook and select the "Install to Halo" button to install it locally to your environment. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjkwOWU0ZjhhLTlmNDYtNGZmNC1hNTMxLTEzNzA3ZjI4ZjE4NCJ9.Yph2c8BMPwQO_fnDLuZNbzkdUmQ2eNosomTIk2dIKiE" class="fr-fic fr-fil fr-dib" width="555" style="width: 557px; height: 340.753px;" height="341"></span></p><p><span style="font-size: 10pt;"><strong>Fig 12a. Entering the runbook online repository</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjFlMmYzYWM3LTYxY2MtNDBiNy05Nzc3LTU4NWMxYjc5M2E5NCJ9.jFEKTqXVGMIx6Z33g-YvIg83CiPczXY-X905zApkE3c" class="fr-fic fr-fil fr-dib" width="751" style="width: 753px; height: 475.865px;" height="476"></span></p><p><span style="font-size: 10pt;"><strong>Fig 12b. Installing the runbook locally</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">When the install button is selected on any runbooks containing Process Agents, a modal window will pop up allowing you to choose the "Agent to log in as". The Agent chosen here is down to your discretion, however best practice would be to choose the "Application Identity" option. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6Ijc2N2NjNDgwLWMzZDItNDViOC05YzQ2LTk2ZTUzYjlhODdmYiJ9.y1A8fPZyJ9Dnq0-dNIgCmgfpAxqKdVCVjdxGdxG7ri0" class="fr-fic fr-fil fr-dib" width="661" style="width: 663px; height: 456.268px;" height="456"></span></p><p><span style="font-size: 10pt;"><strong>Fig 13. Choosing the Halo connection for the Process Agent</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">Once "Install to Halo" is selected, the runbook, Process Agent, and API application will be created in your environment. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong><em>Note: As noted in the "Process Agent" section of this guide, you will need to set the ticket type and report for the "CF_Create_Major_Incident" and "CF_Get_Open_Major_Incidents" Agent functions respectively. See the "Functions" section for more information. This is the only additional configuration needed if setting up the process via this method.</em></strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong><em>Note: If you are on a version prior to 2.250, the runbook will still be available to download from the online repository, but the Process Agent will not be created automatically. As such, you will still need to create the Agent.</em></strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong>Importing From JSON</strong></span></p><p><span style="font-size: 11pt;">The alternative method of creating the runbook is to import the JSON.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong><em>Note: Even if you are on version 2.250 or later, this method of creating the runbook will not automatically create the Process Agent.</em></strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">Download the file attached to this guide labelled "Major Incident Detection JSON", and copy all text within the file. If you are viewing the guide on our website, you will need to <a href="https://support.haloservicedesk.com/portal/kb?btn=46&id=3010" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">view it via our portal</a> in order to access the attachments. </span></p><p><span style="font-size: 11pt;">Select the "Import from JSON" button in the top right corner, paste all of the copied JSON into modal window pop-up, and save. Once successfully imported, the "Halo AI - Agent Major Incident Detection" will appear in your list of runbooks.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjdmMTkzODM2LWNjMGQtNDU0NS05Y2Q1LWQ5MWFmZTRiOThiOSJ9.cdcI7yPWHaIi21LqeelVkth56CRpScK6Z9sH_hKBMaU" class="fr-fic fr-fil fr-dib" width="578" style="width: 580px; height: 327.439px;" height="327"></span></p><p><span style="font-size: 10pt;"><strong>Fig 14. Importing the runbook via JSON</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">Click into the runbook and then into the "Flow Chart" tab. </span></p><p><span style="font-size: 11pt;">Edit the "Major Incident Review" step by editing the runbook and selecting the pencil icon on the step. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImNkNDBhZTRlLWU0ZDctNGFmOC1hNDhmLWU5YjU2MTA3ZmE5NSJ9.8Tn_objgMouPubB9X6ilugzOshAAiKL_HXecjNVOXU8" class="fr-fic fr-fil fr-dib" width="840" style="width: 842px; height: 660.793px;" height="661"></span></p><p><span style="font-size: 10pt;"><strong>Fig 15. Editing the runbook</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">Select the Process Agent that you created earlier from the "Process Agent" drop down field, this sets that Agent to be triggered by the runbook.</span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImZiOTYxMDBjLTk4ODEtNDEyMi1iYWZiLWY3ZmZhODA1ZjA1NiJ9.ciP0RU9P7r9xIbfR9NQObKM3MvnanAtG8q8f9FFZZtg" class="fr-fic fr-fil fr-dib" width="729" style="width: 731px; height: 496.779px;" height="497"></span></p><p><span style="font-size: 10pt;"><strong>Fig 16. Setting the Process Agent to be triggered by the runbook</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">You will notice that the instructions dynamically populate once the Agent is selected. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong><em>Note: If you created your own input variables for the Process Agent, then you will need to edit the variables table visible in Figure 16. This is because the imported JSON will set up these variables according to the pre-built Agent instructions.</em></strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">Once your Agent step is set up, save the step and save the runbook. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><strong>Choose Your Trigger</strong></span></p><p><span style="font-size: 11pt;">Once the Major Incident Detection process is fully configured, the final thing to do is to choose when the runbook will be triggered. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">To do this, click into the "Details" tab of the runbook and locate the "Events" section. This is where you can choose the runbook trigger. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImJhMmZiMmUwLTJkNTMtNDEwMy1iMDg0LWNmMGRhZGExNzRlYyJ9.qj9blijvhYMW9NQaAHeFASwR7mTzVcOf1v-FeOUTO74" class="fr-fic fr-fil fr-dib" width="750" style="width: 752px; height: 325.417px;" height="325"></span></p><p><span style="font-size: 10pt;"><strong>Fig 17. Setting the trigger for the Major Incident Detection runbook</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">In pre-built environments, the trigger is when an incident Ticket is logged. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;"><img src="https://halo.haloservicedesk.com/api/attachment/image?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImJlNjk0ZmVmLWQ1NmMtNDRhOS05MGEyLTY3MjczNDQ5NmRiZiJ9.50KdN3pQz1dKxHP_N9dNWwVV4mAarQWv6ez1YVLtgfE" class="fr-fic fr-fil fr-dib" width="660" style="width: 662px; height: 405.39px;" height="405"></span></p><p><span style="font-size: 10pt;"><strong>Fig 18. The runbook trigger for pre-built environments</strong></span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">For more information on triggering runbooks, see the guide: <a href="https://www.usehalo.com/guides/1630" target="_blank" rel="noopener noreferrer" style="font-size: 11pt;">Custom Integrations/Runbooks</a>. </span></p><p><span style="font-size: 11pt;"><br></span></p><p><span style="font-size: 11pt;">Once your runbook trigger has been configured, your Halo AI Major Incident Detection process is live and ready for use.</span></p>
