Advanced response-plan filters match the ServiceNow fields your team uses, then route each incident to the responder and autonomy mode you choose.
A ServiceNow connection tells Azure SRE Agent which incidents it can see. Advanced filtering narrows that further, so each response plan handles only the incidents it should.
Advanced filters let a plan express the rule your on-call team already follows:
Send High-priority production network incidents owned by the Network group to our network specialist, and require approval for its proposed actions.
The response plan defines the incident criteria, response subagent, and autonomy level. The selected subagent uses the connectors, source code, telemetry, and Azure access already configured on the agent. If you are still building that foundation, see What It Takes to Give SRE Agent a Useful Starting Point.
Match the incidents your team owns
A plan can specify one or more assignment groups. Search by display name or sys_id, then choose the group from the list. The plan keeps the group's stable identity, so renaming it in ServiceNow does not break the scope.
If you leave the plan's assignment group empty, it inherits the group selected under Generate insights when ServiceNow was connected. If no group was selected there, priority, title, and the plan's other filters define the match.
You can narrow the match on fields your team already uses: priority, configuration item, category and subcategory, caller/requestor, location, state, impact, urgency, and severity. Title contains and title does not contain catch patterns those fields miss.
For fields specific to your ServiceNow instance, add up to 20 custom incident fields whose technical names start with u_. Custom fields use exact equality against the stored value. Reference fields normally use the record's sys_id.
If the integration account can read ServiceNow field metadata, the form suggests friendly labels and technical names. Manual entry remains available when discovery is unavailable.
All populated filters use AND matching. Within a multi-select field, an incident can match any selected value. A plan for the Network group, High priority, category network, and u_environment = production runs only when all four conditions match.
Configure the responder
Each plan can use the Meta Agent, when its ServiceNow skill is enabled, or a custom agent with focused instructions, skills, tools, and hooks. Custom agents share the parent SRE Agent's identity, Azure resource scope, and RBAC permissions.
The built-in ServiceNow skill covers common incident actions. For more control, create a skill with your team's procedure and add search, retrieval, or other tools when the workflow needs them.
Then set how far the responder can go on its own:
- Autonomous is the default. The agent investigates and acts within its configured permissions.
- Review lets the agent investigate and propose actions for approval before it changes resources.
Preview and tune the match
Before saving or enabling a plan, preview recent ServiceNow incidents against the filter. Adjust the criteria or time range until the results reflect the incidents you intend to route.
This example intentionally uses a filter with no recent matches.
Start a new plan in Review mode. Move to Autonomous once the team has seen the filter select the right incidents and agrees with the actions the agent proposes.
Get started
Create or open your Azure SRE Agent.
Open Incidents, select Triggers & response plans, and turn on Advanced filters. You can then use the preview in new or existing response plans.
Product documentation:
- Configure ServiceNow response plans for the new filters and preview flow.
- Connect ServiceNow if the incident platform is not configured yet.
- Create a response plan for the end-to-end workflow.
- Create a custom agent to define focused instructions, skills, tools, and hooks.
- Create a skill to add a reusable procedure and its tools.
- Configure agent permissions to set Azure resource access.
Microsoft