Xpert: empowering incident management with query recommendations via large language models

If the system cannot reliably propose the next useful query, it will default to narrative.

“If the system cannot reliably propose the next useful query, it will default to narrative [8], [7], [79].”

By combining language inference with operational tools, language models can support event workflows, including monitoring and diagnostics.

“Recent research demonstrates that by combining language inference with operational tools, language models can support event workflows, including monitoring and diagnostics.[7], [8], [9], [10].”

In incident management, LLM agents help develop systems capable of recommending investigative queries, summarising monitoring signals, and identifying potential root causes.

“In incident management, this helps in developing systems capable of recommending investigative queries, summarising monitoring signals, and identifying potential root causes [7], [8], [10].”

There is a latent system state, operators and automation observe it only through tool-mediated observations, and they apply actions that alter future state.

“There is a latent system state x t (network and service state), operators and automation observe it only through tool-mediated observations o t (logs, metrics, traces, reachability checks), and they apply actions a t (changes, mitigations) that alter future state [1], [10], [8], [18].”

The useful foundation for LLMs in operations is the interface between the model and the operational system: what the model may observe, which tools it may call, what evidence it must collect, which checks it must pass, and how unsafe or uncertain actions are stopped.

“For this reason, the useful foundation is not a general account of prompting or language modelling.It is the interface between the model and the operational system: what the model may observe, which tools it may call, what evidence it must collect, which checks it must pass, and how unsafe or uncertain actions are stopped [9], [7], [8], [67], [31], [74].”

Recent operational assistants collect and structure diagnostic artefacts before asking the model to draw conclusions.

“Recent operational assistants therefore collect and structure diagnostic artefacts before asking the model to draw conclusions [10], [8], [9], [7], [86].”

The reference architecture condenses the safe-autonomy commitments that recur across incident assistants, tool-grounded diagnosis systems, and verification-heavy NetOps workflows.

“It condenses the safe-autonomy commitments that recur across incident assistants, tool-grounded diagnosis systems, and verification-heavy NetOps workflows [8], [7], [10], [9], [1], [3], [47], [51], [76], [67], [31], [74].”

Permissions, verification checks, approval paths, and rollback plans must be part of the architecture from the start.

“permissions, verification checks, approval paths, and rollback plans must be part of the architecture from the start [9], [7], [8], [76].”

The Co-pilot pattern improves operator throughput by compressing and navigating evidence.

“The Co-pilot pattern improves operator throughput by compressing and navigating evidence.”

With agentic LLMs, the system can conduct the investigation as a structured workflow: select the next discriminating query, interpret partial results, maintain competing hypotheses, and draft an action proposal that is tied to evidence, approvals, and rollback.

“What changes with agentic LLMs is not that the system can describe an incident, rather, it is that the system can conduct the investigation as a structured workflow: select the next discriminating query, interpret partial results, maintain competing hypotheses, and draft an action proposal that is tied to evidence, approvals, and rollback [8], [10], [86], [67].”

LLMs can help in log-based AIOps by mapping heterogeneous log language into more stable schemas, condensing long bursts into incident-focused summaries, and suggesting the next query or filter needed to test a hypothesis.

“LLMs can help here by mapping heterogeneous log language into more stable schemas, condensing long bursts into incidentfocused summaries, and suggesting the next query or filter needed to test a hypothesis [8], [67], [10].”

Agentic systems add value in the gaps between incident response stages, where humans spend time translating between representations: ticket text to telemetry queries, telemetry results to hypotheses, hypotheses to mitigations, mitigations to change records.

“Agentic systems add value in the gaps between these stages, where humans spend time translating between representations: ticket text to telemetry queries, telemetry results to hypotheses, hypotheses to mitigations, mitigations to change records [8], [10], [86], [67].”

LLM agents complement causal models by coordinating tools, handling operator intent, summarising evidence, and drafting mitigations for review.

“LLM agents complement this by coordinating tools, handling operator intent, summarising evidence, and drafting mitigations for review [8], [10], [86], [43], [79].”

Xpert studies the role of query writing in a large-scale incident workflow and proposes LLM-supported query recommendations to reduce time-to-signal.

“Xpert studies the role of query writing in a large-scale incident workflow and proposes LLM-supported query recommendations to reduce time-to-signal [8].”

Security and governance depend on the tools an agent can invoke, the permissions attached to those tools, and the checks enforced before action.

“This boundary matters because security and governance depend on the tools an agent can invoke, the permissions attached to those tools, and the checks enforced before action [18], [8], [10].”