How Aiden Automates Incident Remediation After an RCA

TL;DR

• Aiden continues beyond RCA into the next operational workflow.
• Human approval stays in the loop wherever your workflow requires it.
• Every follow-up action runs through a predefined Skill, so the same incident type follows the same operational process every time.
• Any integration connected to Aiden, including ServiceNow and Kubernetes, can become part of a Skill's follow-up action.
  

How to Automate Incident Remediation After an RCA

After the RCA is complete, the workflow may continue with another operational task.

Depending on the incident, Aiden can:

• Create or update a ServiceNow incident
• Attach the RCA to the incident record
• Trigger a remediation runbook
• Roll Kubernetes pods
• Execute operational commands
• Start another operational workflow

These tasks usually follow the same process for similar incidents, making them good candidates for automation.

Human Approval Before Remediation

Some remediation workflows require human approval before they run. 

Here,  Aiden asks whether it should create a ServiceNow incident and include the RCA. After you approve the request and specify the assignment group, Aiden continues with the workflow.

The approval step is part of the Skill. You decide which actions run automatically and which wait for approval. Once that policy is in place, Aiden follows it every time the Skill runs.

Skills Keep Incident Response Consistent

If you've already defined how a particular incident should be handled, there's no reason to recreate that workflow every time it occurs.

Skills give Aiden a predefined workflow to follow. Instead of deciding the next step during the investigation, Aiden executes the process you've already defined for that type of incident.

A Skill defines:

• Which systems Aiden uses
• What information it collects
• Which action it executes
• Whether approval is required before execution

The RCA and findings may change from one incident to the next, but the workflow stays the same.

Operational Workflows You Can Automate

ServiceNow is the example in this walkthrough, but the workflow can extend to any integration connected to Aiden.

A Skill can define actions such as:

• Create or update a ServiceNow incident
• Add the RCA to the incident record
• Trigger a Kubernetes runbook
• Roll Kubernetes pods
• Execute operational commands
• Start an internal workflow

You choose which actions belong in the workflow and where approval is required. Aiden follows that Skill every time.

Complete the Incident Workflow with Aiden

A root cause analysis explains what happened. The next operational step determines how your team responds.

With predefined Skills, Aiden can continue from RCA to ticket creation, remediation, or another operational workflow while following the approval process your team has already defined.

Schedule a demo to see how Aiden handles incident remediation in your own environment.

FAQs

How does Aiden know what action to take after an RCA?

Aiden doesn't decide the next step on its own. Each follow-up action comes from a predefined Skill that specifies what to do after a particular type of incident, whether that's creating a ServiceNow incident, triggering a runbook, or another operational task.

When should you require human approval?

The answer depends on the action. Many teams are comfortable with automatic ticket creation, while production changes often require an engineer's approval. Approval rules are defined as part of the Skill, so the same policy applies every time it runs.

Which tools can Aiden trigger after an incident?

The walkthrough uses ServiceNow as an example, but the same approach works with any integration connected to Aiden. A Skill can trigger Kubernetes runbooks, execute operational commands, or start other workflows that are part of your incident response process.

Do I need a different workflow for every incident?

Not necessarily. A Skill represents the workflow for a specific category of incidents. Similar incidents can follow the same Skill, while different incident types can have their own workflows and approval policies.