Microsoft Xbox · Tech Mahindra · CodeRush 2026 Finalist
IncidentIQ: from a system alert to a ready-to-review fix.
An AI agent for handling production problems. When an alert comes in, it sorts it, looks up similar past incidents, suggests the likely cause, and drafts a fix, but a person reviews and approves every change.
POC complete, intelligence layer in progress. My own concept and architecture; full implementation details shared on request.
Problem
Handling incidents was about 80% manual.
When something broke, engineers created tickets by hand hours later, around 30% of incidents went to the wrong team, and real investigation only started after 20 to 40 minutes of reading logs. The same problems were investigated again and again, because nothing remembered past fixes.
Design Decisions
Safety built in from the start.
1Grounded in real history. The agent only suggests a fix if it can point to a similar past incident or a runbook (a step-by-step guide for a known problem). This prevents the most common AI mistake: confidently inventing a wrong answer.
2Knows when to step back. If it is not confident enough, it hands the incident to a person instead of guessing.
3A person always approves. Nothing is merged automatically; an engineer reviews and owns every code change.
4Protects sensitive data. It removes secrets and private data before anything is sent to the AI model, and logs every action.
5Controls cost. Simple sorting uses a small, cheap model; deeper reasoning uses a bigger one, with a spending cap per incident.
How It Works
Five steps, and it learns over time.
One pipeline takes a raw alert all the way to a draft fix, then feeds the result of every closed incident back in so it keeps getting better.
1Receive
It takes in alerts from monitoring tools and reports from users.
2Analyze
The AI reviews similar past incidents and guides, found using both keyword and meaning-based search.
3Decide
It sets the severity, picks the right team, and suggests a likely cause, along with a confidence score.
4Act
It opens the ticket, creates a code branch, and drafts the fix. It never merges on its own.
5Learn
The outcome of every closed incident is saved so future suggestions get better.
Engineering Challenges
The risks I planned for.
An AI that touches live incident handling has to satisfy a reliability and security reviewer before anyone will trust it.
Acting on a wrong suggestion
A person must review and approve every change before it goes in; nothing applies automatically.
The AI inventing a fake fix
It can only suggest something it can back up with a real source, plus a confidence score that sends shaky cases to a person.
Sensitive data reaching the AI
Secrets and private data are stripped out first, and the AI models do not train on the input.
Cost growing larger than the savings
Cheap tasks use a small model and only deeper work uses a bigger one, with a spending cap per incident.
Built With
Built on Azure's AI tools.
An AI agent layer over Azure OpenAI and smart search, with ongoing quality checks and tracing for every recommendation.
Microsoft Agent FrameworkAzure OpenAI (GPT-4o, GPT-4o-mini)Azure AI Search (hybrid retrieval)RAGAzure FunctionsEvent Grid / Service BusApplication InsightsResponsible AI
Impact
Hours of busywork became minutes of review.
<10 min
Alert to draft fix (proof of concept)
95%
Routing accuracy (proof of concept)
What This Shows
Agentic AI that stays accountable.
The interesting part is not calling an AI model. It is the grounding in real history, the confidence checks, and the rule that a person approves everything, which together make the automation trustworthy. The numbers here are from a proof-of-concept, not a full company-wide rollout.