--- schema_version: "1" id: 6510317f168be5d1dd5fc5482f95dd236dc3506dbaa6af3b3cbe8186434a148b title: AI Actions for Incident Management collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/service/264-0-0/it_srvcs_agentforce_fulfillers_incmgmnt.md canonical_url: https://help.salesforce.com/s/articleView?id=service.it_srvcs_agentforce_fulfillers_incmgmnt.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 2d8953c979d2f9629ada498e6067c72250e10660ac1dd228276895c9a9956676 description: Accelerate incident resolution and improve accuracy by using incident actions. Fulfillers and managers can use incident actions to track and resolve issues efficiently throughout the incident lifecycle. products: - Service Cloud - Agentforce IT Service release: "264" --- # AI Actions for Incident Management Accelerate incident resolution and improve accuracy by using incident actions. Fulfillers and managers can use incident actions to track and resolve issues efficiently throughout the incident lifecycle. ### Required Editions
Available in: Lightning Experience
Available in: Enterprise, and Unlimited Editions with Agentforce IT Service.
## Update an Issue When a VPN connection failure is reported, an incident fulfiller takes ownership and starts investigating the issue. Here’s how an incident fulfiller finds and updates an incident record using Agentforce.
Instructions Example Utterance or User Input Agent response Standard Action Engaged
Verify the key fields and priority of the incident.
  • Can you check the priority of this incident and suggest changes?
  • Does this incident have the correct priority?
  • Is the priority assigned to this incident appropriate?
  • Should the priority of this incident be updated?
 The agent displays the key attributes of the incident (for example, category: Network (VPN), priority: high, status: new, SLA: 2 hours remaining). Check Incident Attributes
Instruct the agent to update one or more fields with new values.
  • Update the priority of the incident
  • Update the status of the incident
  • Change the incident status
 The agent updates the record status to In Progress and confirms the change. Update Record Fields
## Investigate and Resolve an Issue To manage incidents related to VPN connection failures, incident fulfillers use Agentforce to capture key findings, such as summaries, root causes, resolutions, and post-incident reviews. Here’s how an incident fulfiller investigates and resolves issues using Agentforce.
Instructions Example Utterance Agent response Standard Action Engaged
Generate an overview of an incident by using incident record and attached files where an employee’s laptop has a corporate VPN connection issue.
  • Summarize this incident for me.
  • Give me a summary of the incident.
  • Briefly explain the incident.
  • Give me a summary of the incident and its impact.
 The agent generates an incident summary by analyzing incident record and attached files (for example, reported by: Sarah, issue: high-priority VPN connection failure (Error 720), attached screenshot confirms an authentication method mismatch, impact: high, status: new, awaiting investigation). Summarize Incident
Find and link to other incidents or records related to this issue to understand its scope.
  • Find related records to this incident.
  • Are there other similar incidents to this incident?
  • Locate related records associated with this incident.
  • Show me problems related to this incident.
 The agent finds 22 related incidents with error 720 from the last 48 hours and suggests linking them to track a wider issue. Associate Related Records For Incident
After investigating an incident, draft a root cause summary by using incident record and attached files.
  • Create RCA for this issue.
  • Create a root cause analysis for this issue.
  • Generate the root cause analysis.
  • Perform RCA for this issue.
 The agent analyzes the linked incident and its attached files to draft a root cause summary. The root cause summary identifies an incompatibility issue between the latest OS security patch and the corporate VPN client. The attached client log confirms the repeated handshake failures immediately after the patch installation timestamp. Create Incident Root Cause Summary
Generate a potential resolution for the VPN issue based on historical data, incident record and attached files.
  • How could I solve this incident
  • Can you suggest ways to solve this issue
  • Can you suggest ways to solve this incident
 The agent reads the attached files, which help in understanding the incident and proposing the resolution, identifies the specific error shown (for example, VPN Error 720), and finds a relevant knowledge article (KA-0001) from a past incident. It then proposes a fix, which is to uninstall the incompatible VPN client and install the updated version from the Software Center. Propose Resolution Summary For Incident
Evaluate if VPN connections that keep failing after company OS updates are worth creating a problem record to fix the problem and prevent future problems.
  • Does problem need to be created?
  • Should a problem record be created for this incident?
  • Is it necessary to create a problem for this incident?
  • Is creating a problem record required for this incident?
 The agent analyzes recent incidents and recommends creating a problem record based on the findings (for example, 22 related VPN incidents in the last 48 hours, all linked to a recent OS update). It then suggest to create a problem record and associate it with the relevant incidents. Evaluate Problem Creation Requirement

After resolving an incident, draft a summary of the steps taken to fix the VPN connectivity issue by using incident record and attached files.

Note
Note Incident fulfillers copy the resolution summary generated by Agentforce and paste it into the resolution summary field before marking the incident as resolved or closed. This step updates the incident record with a clear summary of the resolution.
  • Draft a resolution summary for this incident detailing the steps taken.
  • Summarize the resolution process based on all actions performed.
  • Create a concise resolution summary for this incident.
  • Generate a final resolution summary using the steps taken.
 The agent generates a resolution summary by analyzing the recorded steps and attached files. The summary states that updating the VPN client resolved the issue. The attached screenshot confirms the client version change and the attached log showing a successful handshake after the update. Create Incident Resolution Summary
At any point in the incident life cycle fulfillers or managers can summarizes multiple incident records based on a certain time and status criteria. This gives a consolidated view for trend analysis and finding common problems.
  • Summarize incidents from the past 10 days
  • Summarize open or closed incidents from the last 25 days.
  • Tell me about incidents from last 3 weeks.
 The agent summarizes incident trends for the specified period (for example, time frame: September 1–11, 2025, total incidents: 84 (65 closed, 10 in progress, 9 new), top trend: 15 incidents related to VPN connection failures). Summarize Multiple Incidents
Generate a post-incident review (PIR) for stakeholders after an incident is resolved by using incident record and attached files. Include timeline, root cause analysis, and preventive measures.
  • Generate a Post Incident Report.
  • Draft a PIR for the incident.
  • Create a closure report for this incident.
  • Prepare a PIR for the incident.
  • Prepare a closure report.
 The agent generates a structured post-incident review (PIR) for VPN Error 720 using data from the incident feed, resolution notes, swarm data, SLAs, and attached files. The report documents the timeline from the initial report, the user impact, the OS patch conflict root cause (confirmed by the attached client log showing handshake failures), and preventive testing measures. After populating the PIR field, the agent prompts you to review or edit the draft. Generate a Post-incident Review
## Collaborate and Communicate on an Issue Agentforce helps incident fulfillers or managers handle major incidents by enabling swarms in Slack, summarizing record channels, and drafting professional updates via email, keeping stakeholders informed throughout the incident lifecycle. Here’s how incident fulfillers or managers can use Agentforce to swarm and communicate about the ongoing VPN connectivity issue.
Instructions Example Utterance or User Input Agent response Standard Action Engaged
Create a summary of the troubleshooting discussion happening in the Slack record channel. This is directly from the Incident record related to the VPN outage.
  • Summarize the record channel.
  • Can you summarize the discussion on the Slack record channel?
  • Provide a summary of the record channel conversation.
  • Summarize the key points from the record channel.
  • Give me a summary of the record channel discussion.
 The agent summarizes the linked record channel on Slack to identify the problem, key contributors, troubleshooting steps, action items, and decisions. Summarize a Slack Channel
Post the final swarming summary to the problem record to document the investigation and resolution plan.
  • Post the summary to the feed.
  • Share the swarming summary on the record feed.
  • Post the final summary to the update feed.
  • Share the swarming discussion summary on the feed.
 The agent posts the generated swarming summary and incident resolution as a new Feed Item on the current record for visibility and historical tracking. Post To Feed
Draft an initial notice acknowledging the VPN outage. After a fix is identified, provide technical details, including attached files to generate ‌ clear resolution communication for employees.
  • Draft an email to all employees about the current VPN outage.
  • Create an email update for all employees about the VPN outage.
  • Compose a notification email to employees about the VPN issue.
  • Draft a message to all employees about the current VPN outage.
 The agent drafts VPN outage communications. The agent sends a broadcast email to acknowledge the issue, followed by a final resolution message detailing the root cause, required client updates, a link to a knowledge article, and evidence from attachments where relevant.

Draft or Revise Email