What you’ll build
You’ll build an intelligent IT support triage system that automatically classifies incoming tickets, attempts automated resolution for common issues using RAG-powered knowledge bases, and escalates complex problems to the appropriate specialist team with full context. This reduces resolution time for common issues from hours to seconds and ensures complex issues reach the right experts immediately. This workflow demonstrates how to:- Automatically classify and route IT support tickets
- Resolve common issues using knowledge base-powered automation
- Implement smart escalation based on issue complexity and severity
- Provide 24/7 first-line support for employees
- Build confidence-based routing for quality assurance
What the system handles
Automated resolution for common issues:- Password resets and account unlocks
- VPN connection problems
- Email configuration
- Software installation instructions
- Printer setup and troubleshooting
- Network connectivity issues
- Standard access requests
- Hardware failures
- Security incidents
- Critical system outages
- Advanced software issues
- Custom application problems
- Database issues
Prerequisites
Before you begin, ensure you have:- MagOneAI instance with workflow builder
- Knowledge base with IT runbooks (optional but highly recommended):
- Troubleshooting guides
- How-to documentation
- Common issue resolutions
- Configuration instructions
- Ticketing system integration (optional) - Jira, ServiceNow, Zendesk, etc.
- LLM provider configured (GPT-4, Claude 3.5 Sonnet recommended)
- Notification tools - Email, Slack, MS Teams
Architecture
The IT support workflow uses classification-based routing with automated resolution attempts:Why this architecture works
Fast Resolution
Common issues resolved in under 30 seconds vs. 2-8 hour wait for human support
Right Routing
Complex issues reach specialists immediately with full context, not bounced between teams
24/7 Coverage
First-line support available anytime, reducing pressure on on-call staff
Learning System
Knowledge base grows over time, handling more issues automatically
Step-by-step build
Create IT knowledge base with runbooks
Build a knowledge base of IT solutions and procedures.Gather documentation:
-
Common Issue Resolutions
- Password reset procedures
- VPN troubleshooting steps
- Email setup guides (Outlook, Gmail, mobile)
- Wi-Fi connection issues
- Printer setup and common errors
- Software installation guides
- Browser troubleshooting
-
Access Request Procedures
- How to request software licenses
- Access control procedures
- VPN access requests
- Admin rights request process
- Shared drive access
-
Security Procedures
- Phishing reporting
- Lost device protocol
- Security incident reporting
- Data breach response
- Suspicious activity reporting
-
Hardware Guides
- Laptop setup guides
- Monitor and peripheral setup
- Mobile device configuration
- Hardware replacement process
- Warranty and repair procedures
- Navigate to Knowledge Bases → Create New
- Name: “IT Support Runbooks”
- Upload documents:
- IT_Runbook_Common_Issues.pdf
- VPN_Troubleshooting_Guide.pdf
- Email_Configuration_Guide.pdf
- Network_Troubleshooting.pdf
- Access_Request_Procedures.pdf
- Security_Incident_Procedures.pdf
- Configure chunking: Automatic (procedure-based chunking works well)
- Wait for processing to complete
Creating effective runbook documents
Creating effective runbook documents
Runbook structure for RAG:This structure helps RAG retrieve the right information at the right time.
Create the triage agent
Build an agent that classifies incoming support requests.Agent configuration:Name: IT Support Triage Agent
Model: GPT-4 or Claude 3.5 SonnetPersona:Configuration:
- Temperature: 0.2 (consistent classification)
- Structured output: Enabled (JSON schema)
- Timeout: 15 seconds
Create the resolution agent
Build an agent that attempts to resolve issues using the knowledge base.Agent configuration:Name: IT Issue Resolution Agent
Model: GPT-4 or Claude 3.5 Sonnet
Knowledge Base: IT Support Runbooks (RAG enabled)Persona:Configuration:
- Temperature: 0.3 (balanced creativity and consistency)
- RAG settings:
- Retrieve: 5 chunks
- Relevance threshold: 0.75
- Enable reranking
- Max tokens: 1000
- Timeout: 30 seconds
Build the workflow with conditional routing
Construct the triage and routing workflow.Node 1: Trigger
- Type: Manual Trigger, API Trigger, or Email Trigger
- Inputs:
user_name(text)user_email(text)issue_description(text, long)ticket_id(text, optional - if integrated with ticketing system)
- Agent: IT Support Triage Agent
- Input:
{{trigger.issue_description}} - Output variable:
triage_result
- Condition:
- True branch: Attempt auto-resolution
- False branch: Go to severity check
- Agent: IT Issue Resolution Agent
- Input:
- Enable RAG: Yes
- Output variable:
resolution
- Tool: Email or Chat response
- To:
{{trigger.user_email}} - Subject:
Re: Your IT Support Request - Possible Solution - Body:
- Condition:
- True branch: Critical escalation
- False branch: Normal ticket creation
- Tool: Notification (Slack, PagerDuty, Email)
- Message:
- Tool: Ticketing system API or Email to IT queue
- Create ticket with:
- Tool: Email
- Subject:
Your IT Support Request Has Been Received - Body:
This multi-branch workflow ensures every request is handled appropriately: auto-resolved, escalated urgently, or queued normally with full context.
Add confidence-based quality assurance
Ensure auto-resolved issues were actually resolved.Enhancement: Follow-up confirmationAfter auto-resolution (Node 5), add:Node 5a: Wait Node
- Wait: 4 hours
- Subject:
Follow-up: Was your IT issue resolved? - Body:
- Timeout: 24 hours
- If no response or “No” clicked: Create ticket (escalate)
- If “Yes” clicked: Close ticket, mark as successfully auto-resolved
Test with common IT scenarios
Validate the workflow with realistic support requests.Test Case 1: Common issue (VPN)
- Input:
- Expected:
- Triage: NETWORK, MEDIUM severity, AUTO resolvable, HIGH confidence
- Resolution: VPN troubleshooting steps from knowledge base
- Output: Auto-reply with step-by-step instructions
- Verify:
- ✅ Correct classification
- ✅ Relevant KB article retrieved
- ✅ Clear instructions provided
- ✅ Follow-up scheduled
- Input:
- Expected:
- Triage: SECURITY, CRITICAL severity, ESCALATE, HIGH confidence
- Route: Immediate alert to on-call
- Output: Critical alert sent + user notified of urgent handling
- Verify:
- ✅ Correctly identified as security incident
- ✅ Marked as CRITICAL
- ✅ On-call team alerted immediately
- ✅ User notified of urgent response
- Input:
- Expected:
- Triage: HARDWARE, HIGH severity, ESCALATE, HIGH confidence
- Route: Create ticket with context
- Output: Ticket created + user notified
- Verify:
- ✅ Correctly classified as hardware
- ✅ Marked for escalation (can’t auto-resolve hardware)
- ✅ Ticket includes full triage analysis
- ✅ User notified with expected timeline
- Input:
- Expected:
- Triage: OTHER/SOFTWARE, MEDIUM severity, UNCERTAIN, LOW confidence
- Route: Create ticket (don’t attempt auto-resolution due to low confidence)
- Output: Ticket created asking for more information
- Verify:
- ✅ Doesn’t attempt auto-resolution (low confidence)
- ✅ Ticket includes request for more details
- ✅ User asked to provide additional context
- Input:
- Expected:
- Triage: ACCESS, MEDIUM severity, AUTO, HIGH confidence
- Resolution: Password reset instructions from KB
- Output: Auto-reply with self-service reset link and instructions
- Verify:
- ✅ Auto-resolved with password reset procedure
- ✅ Includes link to self-service portal
- ✅ Clear instructions provided
Integrate with ticketing system (optional)
Connect to your existing ticketing system for seamless operations.Supported integrations:
- Jira Service Management
- ServiceNow
- Zendesk
- Freshdesk
- Custom ticketing systems (via API)
-
Add API Tool for your ticketing system
- Configure authentication (API key, OAuth)
- Map fields (title, description, priority, category)
-
Modify workflow nodes:
- Node 8 (Create Ticket): Use ticketing API instead of email
- Trigger: Accept tickets from ticketing system webhook
- Auto-resolution: Update ticket status to “Resolved - Auto”
- Escalation: Update ticket and assign to appropriate team
-
Bidirectional sync:
- Ticket updates from system → MagOneAI
- MagOneAI resolution → Update ticket
- Comments and attachments synced
- Centralized ticket management
- No duplicate systems
- Full audit trail
- Reporting and analytics
- SLA tracking
Key concepts demonstrated
Conditional Routing
Dynamically route requests based on AI classification, severity, and confidence scores
RAG with Technical Docs
Use knowledge bases of runbooks and procedures to power automated resolutions
Multi-Branch Decision Trees
Build complex routing logic: auto-resolve vs. escalate vs. critical alert
Tool Integration
Connect to ticketing systems, notification tools, and communication platforms
Confidence-Based Actions
Make routing decisions based on AI confidence to balance automation and quality
Quality Assurance Loops
Follow up on auto-resolutions to ensure they actually worked
Customization ideas
Extend this IT support workflow to handle more scenarios:Add VPN diagnostic sub-workflow
Add VPN diagnostic sub-workflow
Create a specialized workflow for VPN troubleshooting:VPN Diagnostic Agent:
- Asks clarifying questions: OS? Error message? Home or office network?
- Runs through decision tree of common VPN issues
- Provides specific solutions based on answers
- Escalates if all diagnostics fail
- When triage identifies VPN issue, route to VPN diagnostic workflow
- Multi-turn conversation to gather diagnostic info
- Step-by-step troubleshooting with user feedback
- Final resolution or escalation with full diagnostic context
- Higher auto-resolution rate for VPN (common issue)
- Better context when escalating
- Educates users on self-service diagnostics
Integrate with monitoring tools
Integrate with monitoring tools
Proactive issue detection and resolution:Monitoring integration:
- Connect to Datadog, New Relic, Nagios, etc.
- Detect patterns: “Multiple VPN failures from specific location”
- Trigger proactive workflows
- Alert: “VPN server degraded performance”
- Action: Pre-emptively notify affected users
- Message: “We’re aware of VPN issues and working on it”
- Reduce incoming tickets by communicating known issues
- Detect: “Printer offline”
- Action: Restart print spooler service
- Verify: Check if printer is back online
- Notify: “Printer issue resolved automatically”
- Shift from reactive to proactive support
- Reduce ticket volume
- Improve user experience
Add feedback loop for accuracy
Add feedback loop for accuracy
Continuously improve triage and resolution:Feedback collection:
- After resolution: “Did this solve your problem? Yes/No”
- After escalation: Support agent marks if triage was correct
- Track: Which categories/issues have low auto-resolution success
- Auto-resolution success rate by category
- Triage accuracy (were classifications correct?)
- Knowledge base gap analysis (common issues without solutions)
- Average time to resolution (auto vs. human)
- Weekly review of misclassified tickets
- Add missing solutions to knowledge base
- Refine triage agent persona
- Update category definitions
- A/B test triage prompt changes
- Add feedback collection nodes
- Store feedback with ticket data
- Build analytics dashboard
- Schedule weekly review process
Connect to asset management
Connect to asset management
Device-specific troubleshooting:Asset management integration:
- Connect to asset management system (e.g., Jamf, InTune, custom DB)
- Query user’s device info: model, OS, installed software, warranty
- “Laptop won’t turn on” + Asset lookup → Check warranty status
- “Software won’t install” + Asset lookup → Check if compatible with OS version
- “Slow computer” + Asset lookup → Check device age and specs
- Warranty valid → Create RMA ticket
- Warranty expired → Offer replacement options
- Incompatible software → Suggest alternatives
- Old device → Flag for upgrade consideration
- More accurate diagnostics
- Faster resolution paths
- Better inventory management
- Proactive hardware refresh planning
Build self-service portal
Build self-service portal
Empower users to self-diagnose:Self-service features:
- Interactive troubleshooters: Wizard-style Q&A for common issues
- Knowledge base search: User can search runbooks directly
- Status dashboard: Show known issues and outages
- Common requests: One-click password reset, VPN setup guide
- IT Support chatbot available on portal
- Natural language: “How do I connect to Wi-Fi?”
- Escalation: “Contact human support” button always visible
- Portal interactions feed into triage workflow
- Track: Which self-service articles are most used
- Update: Keep popular articles current and clear
- Measure: Reduction in ticket volume from self-service
- Build web portal with chat widget
- Connect to same MagOneAI agents and knowledge base
- Add analytics tracking
- Promote portal during onboarding
Add multi-language support
Add multi-language support
Support global teams:Language detection:
- Detect user’s language from issue description
- Or detect from user profile in HRIS
- Translate incoming issue to English for triage
- Process with English knowledge base
- Translate resolution back to user’s language
- Maintain runbooks in multiple languages
- Route to language-specific KB based on user language
- Ensure terminology consistency across languages
- Based on your employee demographics
- Common: English, Spanish, French, German, Mandarin, Japanese
- Add translation agents or API (Google Translate, DeepL)
- Configure multilingual embedding models
- Test thoroughly for accuracy
- Have native speakers review critical translations
Create escalation SLA automation
Create escalation SLA automation
Ensure timely responses:SLA tracking:
- Define SLAs by severity:
- CRITICAL: 30 minutes
- HIGH: 4 hours
- MEDIUM: 8 hours
- LOW: 24 hours
- 50% of SLA: Reminder to assigned agent
- 75% of SLA: Escalate to team lead
- 90% of SLA: Escalate to manager + alert
- SLA breach: Create incident, notify leadership
- If agent hasn’t responded, auto-reassign to available agent
- If team is overloaded, offer self-service resources to user
- If repeated escalations, suggest knowledge base improvement
- Add timer nodes to track elapsed time
- Condition nodes at SLA checkpoints
- Notification nodes for reminders and escalations
- Integrate with ticketing system SLA features
- SLA compliance rate
- Breaches by category and team
- Average resolution time
- Identify bottlenecks and training needs
Example triage results
Here’s what triage classifications look like:- Auto-Resolvable
- Critical Escalation
- Normal Escalation
- Low Confidence
Input: “I can’t connect to Wi-Fi at the office. It keeps asking for a password but won’t accept mine.”Triage Output:Action: Auto-resolve with Wi-Fi setup guide from knowledge base
Measuring success
Track these metrics to demonstrate value: Efficiency metrics:- % of tickets auto-resolved (target: 30-40% for mature systems)
- Average time to first response (auto vs. human)
- Average time to resolution (auto vs. human)
- % of tickets correctly triaged
- Reduction in L1 ticket volume
- Auto-resolution success rate (user confirms resolved)
- Triage classification accuracy
- Escalation appropriateness (were escalations necessary?)
- SLA compliance rate
- User satisfaction scores
- IT team hours saved per month
- Reduction in average resolution time
- 24/7 coverage without additional headcount
- Improved employee productivity (faster resolutions)
- Knowledge base ROI (solutions reused via RAG)
Next steps
Now that you’ve built an IT support triage workflow, explore related cookbooks:- HR Policy Assistant - Similar RAG-based support automation for HR
- Document Compliance Review - Another conditional routing workflow
- Sales Intelligence Assistant - See more chat-triggered automation
Need help integrating with your specific ticketing system or building custom diagnostic workflows? Contact our solutions team for IT automation guidance.