Disharee Bhowmick

Business problem. L1/L2 support analysts often needed senior SMEs to understand incidents, find similar historical incidents, locate the right SOPs and runbooks, and decide the next troubleshooting steps. The assistant brings those sources together and gives a grounded recommendation. The work was phased: ServiceNow integration, Snowflake loading and BM25 keyword search came first and were in use by analysts; semantic search was added in March 2023 and the GPT-3.5 RAG layer in April–June 2023. The project was still in progress when I left the team in June 2023.

• Built the support-analyst side of a GenAI assistant that helps L1/L2 analysts investigate IT incidents by combining live ServiceNow incident data with a search index over 30–40K historical incidents, tasks and KB articles (loaded from ServiceNow into Snowflake) and SOPs/runbooks.
• Built Python APIs to retrieve live incident details such as priority, description, assignment group, owner and status, then combine them with similar historical incidents and relevant operational documentation.
• Implemented hybrid retrieval over the chunked and embedded records and documents, with BM25 keyword search for exact terms such as error codes, hostnames and KB IDs and Chroma vector search for paraphrased descriptions, to identify relevant incidents, knowledge articles, SOPs and runbooks before passing context to the LLM.
• Developed a RAG layer on GPT-3.5 (gpt-35-turbo) through Azure OpenAI, with prompts restricted to the retrieved sources and designed to generate structured troubleshooting guidance.
• Built a Support Analyst workflow supporting both incident-number based investigation and free-text problem descriptions, returning recommended investigation steps, similar incidents and supporting documentation.
• Developed a Runbook Generator to transform unstructured SOPs into standardized troubleshooting procedures containing symptoms, prerequisites, diagnostic steps, remediation and escalation criteria; long documents were processed section by section and reviewed by an SME.
• Added source references and confidence handling so analysts could distinguish retrieved evidence from model-generated recommendations, with low-confidence cases routed for human/SME review.
• Worked with a DevOps teammate to release the Dockerized FastAPI service through Git-based CI/CD with automated tests and staged deployment; logged queries, retrieved sources, latency, errors and low-quality responses. SMEs and tower leads validated the results.

Incident: INC0012345
Priority: P2
Assignment Group: Database Support

Likely issue:
Connection pool exhaustion on the application database.

Evidence:
- Similar incident INC0098765
- SOP: DB Connection Pool Troubleshooting
- Knowledge Article: DB-104

Recommended investigation:
1. Check active DB connections.
2. Compare connection usage against configured pool size.
3. Review application logs for connection timeout errors.
4. If threshold is exceeded, follow DB-104 remediation procedure.

Confidence: High

Sources: INC0098765 · DB-104 · DB Connection Pool Troubleshooting SOP