What it does
Incident visibility
Browse and search incidents in your ServiceNow instance directly from Luumen. Filter by assignee, priority, state, or free-text.
AI-assisted triage
Start an AI-driven triage session on any incident. The AI proposes investigation steps, commands to run on affected hosts, and likely resolution paths.
Similar-incident retrieval
For the current incident, Luumen finds past incidents with similar symptoms or affected systems using semantic search over your historical ticket data. Resolutions from those tickets become candidate fixes.
Two-way updates
As you triage in Luumen, the AI can append updates and work notes to the SNOW incident. Every update is shown for review before posting.
How triage works end-to-end
Open the incident in Luumen
From the ServiceNow widget or a deep link in a SNOW notification, open the incident in Luumen. The relevant context loads automatically — incident details, affected CI mapping to Luumen hosts (if available), recent agent data for those hosts, and similar past incidents.
Review similar incidents
Luumen surfaces the top similar past incidents in your SNOW history. For each, you see the original symptom, the resolution, and the team that owned it. Click through to read the full ticket.
Start an AI triage session
Kick off a triage chat. The AI has full context on the current incident, the linked hosts, and the similar past incidents. Ask it questions (“Did we see CPU saturation on these hosts in the last hour?”) or let it propose investigation steps.
Run commands with approval
If the AI proposes running a command on a host, you approve it explicitly before it executes. Output streams back into the triage chat and the AI uses it to decide what to do next.
Push updates to ServiceNow
As triage progresses, Luumen can append work notes to the SNOW incident on your behalf — a one-click action with the proposed text shown for review. The incident’s audit trail in ServiceNow stays current without manual copy-paste.
Retrieval-augmented generation (RAG)
The AI’s similar-incident lookups use RAG over your historical incident data. In practice that means:- Your data, your context. The AI doesn’t generalize from public incident corpora — it retrieves from your own incident history, weighted by relevance to the current incident.
- Fresh data. New incidents are indexed continuously, so a fix that was put in place yesterday is available as a reference for an incident raised today.
- Cited suggestions. When the AI suggests a fix, it cites the specific past incidents it drew on. You can verify the source before acting.
What you’ll set up
Connection setup is a single field in your workspace settings:- A ServiceNow API key scoped to read the incident table (and any other tables you want Luumen to use — problem, change, etc.), plus write access to incident comments and state if you want the two-way update capability.
Audit and control
- Every write is logged. Comments, state changes, and assignment updates Luumen makes are tagged in the SNOW audit log as actions by the API key’s identity, and in Luumen’s audit log with the user who initiated them. We recommend a dedicated SNOW user behind the API key so the audit trail is unambiguous.
- No silent writes. Updates to SNOW happen only after a user approves them. There’s no “AI autopilot” mode.
- Opt-out per workspace. AI triage and similar-incident retrieval can be enabled or disabled at the workspace level. See your workspace settings.
Limits
- No bidirectional sync of CMDB or assets. Luumen doesn’t write its host inventory into SNOW’s CMDB. Affected-CI mapping is best-effort using hostname matching.
- Read-only on other tables by default. Only the incident table supports two-way updates. Problem, change, and request tables are read-only unless you specifically scope additional write access.
- English-language indexing. Similar-incident retrieval is tuned for English ticket text today. Multi-language support is on the roadmap.