Custom Agent Studio
Design small, focused 2-4 step automation flows without writing code. Pick a trigger, wire the steps, hit deploy - the studio's orchestration layer executes every step.
- No-Code Flow Builder
- 40+ Native Connectors
- Orchestrated Execution
- Deploy in minutes
- Event-Driven Triggers
- Pick a TriggerChoose what fires the agent - an incoming email, a Slack or Teams channel message, an alert, a schedule, a webhook, a threshold breach, or a manual button.
- Add Steps (2-4)Drag in actions from your connected tools - fetch data, run a command, create a ticket, send a notification.
- Configure & TestSet conditions, map fields, define approval gates. Run a dry-run against real data before going live.
- Deploy & MonitorOne click to activate. The orchestration layer runs the agent, logs every execution, and alerts you on failures.
For Business Teams
A message arrives. The work gets done.
Agents are not only for operations engineers. Business users describe what they need in natural conversation, pick the trigger their team already lives in, an email inbox, a Slack channel, a Teams channel, and the agent does the work from there: reading the request, checking the systems, executing through governed APIs, and replying where the request came from.
- ✉ Email mailbox
- # Slack channel
- Teams channel
- Schedule
- Webhook / Form
- ▶ Manual button
- FinanceInvoice intake from a mailboxTrigger: an email lands in invoices@yourcompany
The agent reads the invoice attachment, extracts vendor, amount and PO number, validates them against the purchase order in your ERP, routes the approval to the right manager in Teams, and files the record. Only a mismatch reaches a human.
Invoices processed without anyone opening the mailbox - IT HelpdeskRequests resolved in the channelTrigger: a message posted in #it-requests on Slack
The agent understands the ask in plain language, access request, password reset, software install, checks the requester's own entitlements under RBAC, executes through designated APIs or raises the right ticket, and replies in-thread with the result.
Routine requests closed where they were asked - HROnboarding that runs itselfTrigger: a new-joiner event from HR systems, or a manager's email
The agent creates accounts through identity APIs, requests hardware, schedules orientation invites, posts the welcome in the team's channel and tracks every step to completion, escalating only what stalls.
Day-one readiness without a checklist owner - SupportEscalations arrive pre-briefedTrigger: a message posted in the escalations Teams channel
The agent pulls customer context from CRM and recent incidents, summarizes the state of play, creates or updates the case, notifies the owner and posts the briefing card back into the channel before anyone asks "what do we know?"
Every escalation starts with the context attached
Every one of these runs on the same governed rails as the engineering use cases below: the agent acts under the requesting user's own access (RBAC and ABAC enforced), touches systems only through designated APIs, and logs every step. Engineers who want the full lifecycle, prompts, certification, A2A, AgentOps, should see Agent Studio →
Alert to Auto-Ticket Agent
When a monitoring alert fires, automatically create a fully-enriched ITSM ticket - no human needed.
The problem
Every monitoring alert that matters needs an ITSM ticket. But engineers create them manually - often late, always inconsistently. P1 alerts sit untracked for 15-40 minutes while someone decides who creates the ticket and what to put in it. By the time the ticket exists, half the context is already lost.
- Manual Ticket CreationOn-call engineers spend precious minutes writing tickets during high-stress incidents.
- Lost ContextManually written tickets miss topology, recent deploys, and correlated alerts.
- Duplicate TicketsMultiple engineers create tickets for the same alert. No deduplication.
- SLA Clock Not StartedIf the ticket is late, your SLA timer hasn't started - impacting compliance.
The flow
- TRIGGERAlert FiresDatadog / CloudWatch / Prometheus threshold breached. Webhook delivered to the agent.
- PROCESSEnrich ContextThe agent fetches: service topology, recent deployments, correlated alerts, affected CI from CMDB.
- ACTIONCreate TicketServiceNow incident created with priority, affected service, enriched description, and assigned team.
- OUTCOMENotify + TrackSlack message sent to ops channel. Alert linked to incident. SLA clock started automatically.
Connectors
- DatadogMonitoring Source
- Receive alert webhook
- Query service topology
- Fetch related metrics timeline
- ServiceNowITSM
- Create incident record
- Set priority + assignment group
- Attach alert payload as attachment
- SlackNotification
- Post to #ops-incidents channel
- Include ticket link + severity
- @mention on-call engineer
- CMDBContext Source
- Resolve affected CI from service name
- Fetch owner + team info
- Attach dependency map
How it is built
- Step 1 - Set the TriggerIn Agent Studio, New Agent, Trigger Type: Webhook. Paste your Datadog webhook URL. Set filter: only fire when alert.severity is "critical" or "high". Toggle "Deduplicate by alert.group_key" ON to prevent duplicate tickets.
<span class="key">trigger:</span> <span class="val">webhook</span> <span class="key">filter:</span> <span class="key">severity:</span> <span class="val">[critical, high]</span> <span class="key">state:</span> <span class="val">ALERT</span> <span class="key">dedup_key:</span> <span class="val">alert.group_key</span>
- Step 2 - Enrich with ContextAdd a "Fetch" step. Connect to your CMDB connector. Map alert.service_name to cmdb.query(service). The studio will auto-join topology data and last-3-deploys from your CI/CD connector if enabled.
<span class="key">step:</span> <span class="val">enrich</span> <span class="key">connectors:</span> <span class="val">[cmdb, datadog_api]</span> <span class="key">fetch:</span> <span class="key">- cmdb.ci_record(</span><span class="val">service_name</span><span class="key">)</span> <span class="key">- datadog.related_alerts(</span><span class="val">last_30m</span><span class="key">)</span> <span class="key">- ci_cd.last_deploys(</span><span class="val">count=3</span><span class="key">)</span>
- Step 3 - Create ServiceNow IncidentAdd a "Create Record" step using the ServiceNow connector. Map fields: short_description from alert.title, priority from severity mapping table (critical to P1, high to P2), assignment_group from cmdb.owner_team. Enable "Return ticket URL" for the next step.
<span class="key">step:</span> <span class="val">create_record</span> <span class="key">connector:</span> <span class="val">servicenow</span> <span class="key">table:</span> <span class="val">incident</span> <span class="key">fields:</span> <span class="key">short_description:</span> <span class="val">{{alert.title}}</span> <span class="key">priority:</span> <span class="val">{{severity_map[alert.severity]}}</span> <span class="key">assignment_group:</span> <span class="val">{{cmdb.owner_team}}</span> <span class="key">description:</span> <span class="val">{{enriched_context}}</span> - Step 4 - Notify via SlackAdd a "Send Message" step using the Slack connector. Use the #ops-incidents channel. Include: ticket link, severity badge, affected service, and @mention the on-call user fetched from PagerDuty schedule.
<span class="key">step:</span> <span class="val">notify</span> <span class="key">connector:</span> <span class="val">slack</span> <span class="key">channel:</span> <span class="val">#ops-incidents</span> <span class="key">message:</span> <span class="val">"{{alert.severity}} | {{alert.title}}"</span> <span class="key">attachments:</span> <span class="key">- ticket_url:</span> <span class="val">{{snow.ticket_link}}</span> <span class="key">- oncall:</span> <span class="val">{{pagerduty.current_oncall}}</span>
What it runs on
- Orchestration EngineSentinel core
- Webhook Listener
- Field Mapper
- Condition Logic
- Deduplication Guard
- Slack Notifier
- ServiceNow Connector (read/write)
- Datadog Webhook Receiver
- CMDB Lookup
- Slack Bot Token
- PagerDuty Schedule API (optional)
The outcome
Every qualifying alert creates a properly enriched ServiceNow incident within seconds - with zero human involvement. On-call engineers wake up to a ticket that already has the context, ownership, and SLA clock running.
- SecondsAlert to ticket creation time
- FullAlert coverage - no incident missed
- MinutesSaved per incident per engineer