You've already forked incident-triage
Import UAPF package
99 lines
3.0 KiB
YAML
99 lines
3.0 KiB
YAML
kind: uapf.algorithm.card
|
|
id: algo.incident_triage.suggest_priority
|
|
version: 1.0.0
|
|
name: Priority suggester
|
|
intent: |
|
|
Reads the classified incident plus its service-tier and reported
|
|
severity and proposes a priority on the P1..P4 scale. This output is
|
|
a SOFT suggestion only — the priority DMN table makes the binding
|
|
decision, with this suggestion as one of its four input columns.
|
|
Separating "AI suggestion" from "binding decision" keeps the AI
|
|
contestable and the auditor's job tractable.
|
|
algorithm_kind: classifier
|
|
|
|
io:
|
|
inputs:
|
|
- id: severity
|
|
type: string
|
|
constraints:
|
|
enum: [disaster, critical, high, average, warning, low, info]
|
|
documentation: Source-reported severity (Zabbix verbatim; normalised for other adapters).
|
|
- id: service_tier
|
|
type: string
|
|
constraints:
|
|
enum: [tier_1, tier_2, best_effort]
|
|
documentation: Service tier of the affected service (from the connection or host catalog).
|
|
- id: classification
|
|
type: string
|
|
documentation: |
|
|
Taxonomy code from ai.classify@1. The suggester applies a fixed
|
|
elevation for security.incident regardless of severity.
|
|
outputs:
|
|
- id: priority
|
|
type: string
|
|
constraints:
|
|
enum: [P1, P2, P3, P4]
|
|
- id: reason
|
|
type: string
|
|
documentation: One-sentence justification (English). Visible to operator.
|
|
|
|
implementation:
|
|
type: external
|
|
medium: mcp_tool
|
|
uri: uapf-ip://capability/ai.suggest_priority@1
|
|
hash: sha256:0000000000000000000000000000000000000000000000000000000000000000
|
|
runtime:
|
|
capability: ai.suggest_priority@1
|
|
note: |
|
|
Host-fulfilled UAPF-IP capability. The OpenITSM host can answer
|
|
via either the LLM gateway or a deterministic rule. The DMN
|
|
priority table downstream applies a binding decision on top.
|
|
|
|
determinism: stochastic
|
|
side_effects: pure
|
|
complexity:
|
|
typical_latency_ms: 600
|
|
max_latency_ms: 30000
|
|
failure_mode: |
|
|
Returns priority='P4' with reason='LLM unavailable, defaulted'. The
|
|
binding DMN can still raise the priority based on severity x tier.
|
|
|
|
owners:
|
|
- type: team
|
|
id: openitsm-stewards
|
|
contact: stewards@openitsm.algomation.io
|
|
|
|
lifecycle:
|
|
status: draft
|
|
|
|
tests:
|
|
- name: disaster-on-tier1-is-p1
|
|
description: |
|
|
Disaster severity on a tier_1 service is always P1 regardless of
|
|
classification.
|
|
inputs:
|
|
severity: "disaster"
|
|
service_tier: "tier_1"
|
|
classification: "network.outage.link_down"
|
|
expected_outputs:
|
|
priority: "P1"
|
|
- name: security-incident-elevates
|
|
description: |
|
|
Security incidents elevate to P1 regardless of severity field.
|
|
inputs:
|
|
severity: "average"
|
|
service_tier: "tier_2"
|
|
classification: "security.incident"
|
|
expected_outputs:
|
|
priority: "P1"
|
|
- name: customer-request-low
|
|
description: |
|
|
A customer service request on best_effort tier is P4 unless
|
|
escalated by an operator.
|
|
inputs:
|
|
severity: "info"
|
|
service_tier: "best_effort"
|
|
classification: "service.customer_request"
|
|
expected_outputs:
|
|
priority: "P4"
|