An example of NOC incident triage as a governed process: agents do the 9 steps, and a person signs the gate before anything irreversible happens. Download it, import it into your workspace, and adapt it to your systems.
The graph9 agent steps1 human gatesigns: NOC duty manager (incident commander)
Network incident triage & routing autopilot
NOC engineers manually swivel-chair every incoming ticket across CMDB, topology, and change records to classify, prioritize, and route it — 200K-1M tickets/yr at 5-15 minutes each. Mis-routes bounce between queues for hours and blow contractual SLAs, turning a clerical step into direct SLA-penalty exposure. Agents auto-classify, enrich, prioritize, and route routine incidents to the right resolver queue at the committed severity in seconds, clearing the swivel-chair backlog. Only the genuine judgment calls — declaring a Sev-1/major incident or confirming a severity downgrade that could waive SLA credits — reach the NOC duty manager, who signs the irreversible severity commit before anything fires.
The governed flow · branches, parallel work & a human on the irreversible step
Pull the raw incident, alarms, and customer/circuit context from the ticketing and alarm systems
parallel · fan-out / join
Run topology/CMDB enrichment and change-record correlation concurrently
agent · low risk
Enrich from CMDB and live topology to find affected services, blast radius, and likely failure domain
agent · low risk
Correlate against recent change records and maintenance windows to spot a probable change-induced cause
parallel · fan-out / join
Merge enrichment and change-correlation results
agent · medium risk
Classify the incident type and compute a proposed severity and SLA tier against the priority matrix
agent · medium risk
Draft the routing decision and resolver queue assignment with a confidence score and rationale
decision
Judgment call needed? (Sev-1/major, SLA-credit-waiving downgrade, or low routing confidence)
agent · medium risk
Routine: provisionally route to the resolver queue at the proposed standard severity with full rationale — a reversible in-policy assignment, no Sev-1 page
agent · medium risk
Judgment call: assemble the evidence pack (severity rationale, affected services, SLA-credit exposure, routing options) and hold pending duty-manager review
gate · human sign-off
A NOC duty manager signs off declaring a Sev-1/major incident or confirming a severity downgrade that could waive SLA creditssigns: NOC duty manager (incident commander)
agent · high riskirreversible
Commit the severity and SLA clock and route the ticket to the assigned resolver queue, paging on-call for major incidents
agent · low risk
Track mis-route bounces, SLA breach risk, and re-triage tickets returned by resolvers
Done
low riskmedium riskhigh riskbranch / reworkgate · human sign-off
Use this example
01
Download the file
A minctrl.process/v1 document: the graph and the hash of the process it becomes.
02
Import it in Processes
Import into Minctrl opens this example in your workspace; one click stores it as your first version. Import JSON does the same with the file, and a file changed after download is refused.
03
Connect your systems
Every connector starts in shadow: steps run, nothing leaves Minctrl until you configure a connector and switch it live.
04
Adapt it
Change signers, time limits and steps on the canvas. Each save is a new version; a running case stays on the version it started with.
Questions
How do I automate NOC incident triage with Minctrl?+
Start from this example. Import the file in Processes, connect your own systems, and adapt the steps on the canvas. Agents run the reversible steps; every irreversible step waits at a gate for the role you choose. The example has 9 steps and 1 gate; you can change any of them.
Is NOC incident triage in Minctrl auditable?+
Every run start, signature and change to the process is written to a hash-chained audit log your auditor can verify and export. A run is pinned to the exact graph it started on.
Does the AI decide everything?+
No. Minctrl will not make a process runnable while an irreversible step can be reached without a human gate, and one person cannot sign two gates of the same run.