Modern organizations generate an enormous volume of operational data through ticketing systems, incident reports, service requests, support escalations, and more. These tickets often hold critical signals about systemic issues, recurring pain points, and team performance. But extracting insights from them is a challenge.
Most ticketing platforms are built for workflow execution, not evaluation. Structured fields are inconsistent, free-text descriptions are noisy, and cross-ticket relationships are rarely captured or queryable.
So when leadership asks…
- “What are the highest recurring issues across our org?”
- “Which teams are repeatedly coping with the identical root causes?”
- “Why are certain groups resolving tickets faster or slower than others?”
- “Where are we seeing gaps in resolution quality or consistency?”
…you’re left cobbling together brittle queries, exports, or spreadsheets—in the event you even try in any respect.
ITelligence, an internal AI agent built by NVIDIA’s IT organization, combines the advanced AI reasoning of NVIDIA Nemotron open models with the expressive power of graph databases. The aim of the agent is twofold: 1) to uncover hidden insights inside unstructured support ticket data by effectively leveraging LLMs to generate contextual insights. And a couple of), to make use of graph-based querying to trace relationships, discover anomalies, and discover patterns at scale.
This blog post goals to share our learnings and supply a practical guide for others to construct similar, powerful AI-driven intelligence agents in their very own organizations.
While the described implementation focuses on IT operations, the proposed architecture and workflow are domain-agnostic and may be applied to any ticketing-based environment where unstructured records have to be translated into structured insights—including security incident response, customer support platforms, or facilities management systems.
The core of the system is a modular, scalable data pipeline that ingests, enriches, and analyzes operational data to power root causes and insight generation. The architecture consists of the next key stages:
1. Data ingestion and graph modeling
Scheduled extract, transform, load (ETL) jobs may be used to extract data from multiple enterprise systems, including IT service management (ITSM) platforms (e.g., incident and request tickets), endpoint inventories, and identity sources. As an alternative of using a streaming platform or event-driven ingestion, we go for a batch-based approach. This decision is driven by the proven fact that our use case can tolerate eventual consistency. Real-time ingestion was not vital for our evaluation, and periodic ETL jobs provide a less complicated, more maintainable solution that aligns well with our operational needs.
Each data stream is normalized and loaded right into a graph database, where entities are modeled as nodes (e.g., User, Incident, Device, Group, ServiceRequest) and their associations are modeled as relationships (e.g., OPENED_BY, ASSIGNED_TO, HAS_DEVICE, ASSIGNED_TO, REPORTS_TO).
This graph representation enables flexible, multi-hop querying that might be prohibitively expensive or complicated in traditional relational or flat reporting structures.
As an example, in the next figure, a straightforward graph query captures a posh operational pattern, revealing beneficial insights across tickets, users, root causes, management chain, and project groups in a single analytical view.
2. Contextual enrichment jobs
To reinforce each ticket with richer context, run enrichment jobs that join auxiliary attributes to users and devices on the time of the ticket. Examples include:
- Whether the ticket opener is a brand new hire (derived from the opener’s start date and the ticket’s open date)
- Device type (primary and secondary)
- Work mode (distant, hybrid, on-site)
- Employment type (contractor vs. full-time)
- user_created or bot_generated based on the source identifier or request origin
These enrichments can add semantic depth to the graph and permit downstream analytics to segment data by relevant dimensions without counting on user-filled fields.
3. Root cause evaluation (RCA) jobs
Determining true root causes is usually beyond the capabilities of ordinary ITSM classification. To unravel this, we are able to invoke an LLM pipeline that processes each ticket individually. For each ticket, we are able to pass:
- The user’s reported issue (symptom)
- Closed notes from IT staff (actual resolution)
- Any enriched metadata
We will then prompt the LLM to extract a concise, comma-separated list of root cause keywords that represent the true nature of the difficulty (e.g., YubiKey, passkey, Microsoft Authenticator, registration) for every individual ticket. These generated RCAs may be stored as a brand new property on the ticket node, enabling precise grouping and evaluation beyond traditional ITSM categories.
We tested different open source models available via NVIDIA NIM for this purpose, and essentially the most accurate results were achieved with llama-3_3-70b-instruct
4. Insight generation jobs
Once tickets are enriched with structured RCAs, we are able to run scheduled insight-generation jobs that synthesize organization- or team-level patterns using LLMs. These jobs may be prompt-engineered for various insight types:
- MTTR insights: The system can select tickets with the very best resolution times and prompt the LLM to summarize why those cases took so long—highlighting delays, misroutes, dependencies, or gaps in standard operating procedures.
- Customer satisfaction insights: For tickets with a low customer satisfaction rating (CSAT) or poor user feedback, we are able to generate executive-level summaries that highlight unmet expectations, recurring complaints, and potential areas for improvement—grouped by team or org.
- RCA insights: Selects tickets with essentially the most frequent root causes (based on AI-generated RCAs). The LLM may be prompted to extract common symptoms, recurring resolution steps, and high-level patterns across these tickets—enabling teams to discover underlying systemic issues.
- Latest hire insights: Analyze tickets opened by latest hires to surface onboarding pain points and early struggles, providing clear, actionable feedback to leaders on gaps and areas for improvement.
These insights may be tied back to the graph context (e.g., team, manager) to supply targeted, actionable intelligence per leader, group, or service owner.
5. Distributed alerting and automatic insights delivery
To operationalize insights, we are able to construct a distributed alerting system that constantly evaluates KPI trends across the graph. Predefined rules can trigger notifications when metrics drift beyond expected thresholds—for instance, a spike in mean-time-to-resolve (MTTR) repeated RCAs, or a drop in CSAT. These alerts may be sent on to relevant leaders or managers with context, affected tickets, and suggested focus areas.
This framework will also be used to deliver automated, AI-generated newsletters on an everyday cadence. Each newsletter may be tailored per org or manager and might include:
- Top RCAs and recurring patterns
- High-impact tickets affecting key performance indicators (KPIs) like MTTR
- Summarized user feedback from low CSAT cases
- Week-over-week KPI trends
All insights are LLM-generated using structured prompts and enriched ticket data, ensuring every stakeholder receives targeted, context-aware summaries robotically.
This layered architecture, rooted in clean graph modeling and precise prompt engineering, allows the system to scale insight generation while staying adaptable to latest data sources, org structures, and use cases.
With a wealthy, highly connected dataset powering the system—and spanning tickets, users, root causes, org hierarchies, devices, and more—data retrieval must be each powerful and accessible. Users shouldn’t need to know the underlying graph schema, write Cypher queries, or depend on custom scripts to explore operational insights.
We’d like an interface that:
- Allows users to slice and filter data by meaningful dimensions
- Supports each structured queries and on-demand summarization
- Is intuitive enough for analysts and managers without deep technical expertise
- Reduces ambiguity and promotes accuracy in interpreting user intent
This leads us to judge two interface paradigms: conversational chatbots (using retrieval-augmented generation (RAG) + LLM) and interactive dashboards.
Given the complexity of the info model and the necessity for precision in interpreting user intent, we intentionally select the latter—interactive dashboards—as the inspiration of the platform interface. It offers a transparent, reliable, and user-friendly method to navigate and extract insights from a highly structured graph.
Why not a RAG-based chatbot?
Given the recent momentum around RAG and conversational AI, it’s natural to ask: Why not only construct a chatbot interface over the graph?
While the thought is appealing, we imagine it falls short in practice, especially when working with a wealthy and highly relational schema.
On this case, the underlying database comprises many interconnected entities and properties: tickets, users, devices, hierarchy, root causes, teams, services, project groups, etc. Translating open-ended natural language queries into precise, executable graph queries shouldn’t be just non-trivial, it’s error-prone and infrequently ambiguous.
The goal is to improve user productivity, not burden users with back-and-forth interactions simply to make clear their intent in a chatbot interface. When users need answers, they need to get them quickly and accurately, without guessing how one can phrase an issue to make the system understand.
For instance, when a user asks:
“What are essentially the most common issues related to VPNs recently?”
That query can map to multiple intents:
- Filter tickets where the foundation cause is VPN
- Filter tickets where the project group related to VPN
- Filter tickets that mention VPN in the outline or metadata
- Interpret “recently” because the last seven days, 30 days, or a default time window, depending on user expectation
The model must resolve this ambiguity without guessing, which is incredibly difficult with complex schemas and overlapping concepts. Generating accurate Cypher (or any query language) on the primary attempt is unreliable, and debugging incorrect queries via chat is frustrating for end users who lack context in regards to the underlying graph schema.
Advisable approach: AI-powered dashboard with on-demand summarization
To make insights each accessible and interactive, we recommend integration with interactive data-visualization platforms (we selected Grafana) powered by the graph database and a custom summary API service. All static data akin to metrics, KPIs, pre-generated insights, tickets and their metadata, may be pulled directly from the graph in real time.
Nevertheless, one area of manual toil stays: Even after filtering tickets by criteria akin to RCA = driver, audio and Task Group = X, Y, users must manually review individual tickets to uncover common pain points and backbone patterns. This makes evaluation slow and difficult to prioritize systemic improvements.
To automate this workflow, we are able to introduce a summary service API that connects on to the Grafana dashboard. When a user selects filters, akin to org, project group, root cause, or category, those variables may be sent to the summary service API as a JSON payload via an Infinity data source tied to a Business Text panel.
On the backend, the summary service can:
- Receive the chosen criteria (i.e., user chosen variables from the dashboard)
- Retrieve matching tickets from the graph
- Inject them right into a structured prompt
- Send the prompt to the NVIDIA NIM API (Try construct.nvidia.com to start) for LLM-based summarization
- Return the response to the info visualization platform for display
The output can then be rendered within the AI-generated summary panel, delivering a concise executive summary that features:
- Common issues and symptoms
- Typical resolution paths
- Recurring failure patterns (location, employment type, device, etc.)
- AI-generated recommendations
This removes the necessity for manual ticket triage and provides teams on-demand, contextual understanding, right from the dashboard.
This AI agent is designed to bridge a critical gap in IT ticketing operations: the challenge of deriving meaningful insights from large volumes of unstructured ticket data. By integrating AI-powered evaluation, graph-based modeling, and versatile querying, the platform turns operational noise into clear, actionable intelligence.
From automated root cause identification and wealthy contextual enrichment to real-time executive summaries and proactive alerting, the agent can equip teams with the clarity and speed needed to make informed decisions.
Not sleep thus far on NVIDIA Nemotron by subscribing to NVIDIA news and following NVIDIA AI on LinkedIn, X, Discord, and YouTube.
Browse video tutorials and livestreams to get essentially the most out of NVIDIA Nemotron
