Microsoft Xbox · Tech Mahindra · CodeRush 2026 Finalist

IncidentIQ: from a system alert to a ready-to-review fix.

An AI agent for handling production problems. When an alert comes in, it sorts it, looks up similar past incidents, suggests the likely cause, and drafts a fix, but a person reviews and approves every change.

POC complete, intelligence layer in progress. My own concept and architecture; full implementation details shared on request.

AI incident intelligence dashboard and analytics

Problem

Handling incidents was about 80% manual.

When something broke, engineers created tickets by hand hours later, around 30% of incidents went to the wrong team, and real investigation only started after 20 to 40 minutes of reading logs. The same problems were investigated again and again, because nothing remembered past fixes.

Design Decisions

Safety built in from the start.

1

Grounded in real history. The agent only suggests a fix if it can point to a similar past incident or a runbook (a step-by-step guide for a known problem). This prevents the most common AI mistake: confidently inventing a wrong answer.

2

Knows when to step back. If it is not confident enough, it hands the incident to a person instead of guessing.

3

A person always approves. Nothing is merged automatically; an engineer reviews and owns every code change.

4

Protects sensitive data. It removes secrets and private data before anything is sent to the AI model, and logs every action.

5

Controls cost. Simple sorting uses a small, cheap model; deeper reasoning uses a bigger one, with a spending cap per incident.

How It Works

Five steps, and it learns over time.

One pipeline takes a raw alert all the way to a draft fix, then feeds the result of every closed incident back in so it keeps getting better.

1

Receive

It takes in alerts from monitoring tools and reports from users.

2

Analyze

The AI reviews similar past incidents and guides, found using both keyword and meaning-based search.

3

Decide

It sets the severity, picks the right team, and suggests a likely cause, along with a confidence score.

4

Act

It opens the ticket, creates a code branch, and drafts the fix. It never merges on its own.

5

Learn

The outcome of every closed incident is saved so future suggestions get better.

Engineering Challenges

The risks I planned for.

An AI that touches live incident handling has to satisfy a reliability and security reviewer before anyone will trust it.

Acting on a wrong suggestion

A person must review and approve every change before it goes in; nothing applies automatically.

The AI inventing a fake fix

It can only suggest something it can back up with a real source, plus a confidence score that sends shaky cases to a person.

Sensitive data reaching the AI

Secrets and private data are stripped out first, and the AI models do not train on the input.

Cost growing larger than the savings

Cheap tasks use a small model and only deeper work uses a bigger one, with a spending cap per incident.

Built With

Built on Azure's AI tools.

An AI agent layer over Azure OpenAI and smart search, with ongoing quality checks and tracing for every recommendation.

Microsoft Agent FrameworkAzure OpenAI (GPT-4o, GPT-4o-mini)Azure AI Search (hybrid retrieval)RAGAzure FunctionsEvent Grid / Service BusApplication InsightsResponsible AI

Impact

Hours of busywork became minutes of review.

<10 min

Alert to draft fix (proof of concept)

95%

Routing accuracy (proof of concept)

Every change

Human review

What This Shows

Agentic AI that stays accountable.

The interesting part is not calling an AI model. It is the grounding in real history, the confidence checks, and the rule that a person approves everything, which together make the automation trustworthy. The numbers here are from a proof-of-concept, not a full company-wide rollout.