Skip to content
NexusBook a demo

Enterprise use case · Amazon Web Services + ServiceNow + OpenAI

Alert classification and grouping

Several alerts can describe one failure, while superficially similar alerts can concern different resources or incidents. Operators receive proposed incident groups with their underlying AWS alerts preserved and the grouping rationale recorded.

Discuss this use case Enterprise overview

Systems involved

What each system contributes

Amazon Web Services

61 actions

  • EC215
  • Lambda10
  • S315

Trigger source: AWS S3, AWS SNS, AWS SQS, AWS CloudWatch, AWS CloudWatch Events

ServiceNow

55 actions

  • Incidents12
  • CMDB12

Trigger source: ServiceNow

OpenAI

25 actions

  • Chat Completions8

AWS pre-built actions cover EC2, S3, IAM and Lambda. Other event or monitoring reads use authorized AWS APIs or Rules + Code in the same workflow. The model step runs against the AI provider you choose, including Anthropic, Google Gemini or a model you host yourself. Anything outside a pre-built action runs through an API, protocol or database call, or as Rules + Code in Python, Bash, Go, Java, .NET, PHP, PowerShell or JavaScript/TypeScript, with the same approvals and audit.

Architecture

One governed run

Trigger: alert / scheduleIntegration: AWS + ServiceNowRules + CodeAI step: model of your choiceHuman ApprovalSystem Action: ServiceNowAudit

How it starts: An AWS alert set or an updated ServiceNow incident enters the configured operations-triage process.

Step by step

How the process runs

  1. 01

    Collect the alert context

    Read the approved AWS events and resource details through the configured interface, alongside relevant ServiceNow incidents.

  2. 02

    Apply exact checks

    Rules identify repeated event identifiers and establish resource and time-window boundaries before semantic grouping.

  3. 03

    Propose incident groups

    The selected model compares symptoms and available resource context to suggest which alerts may describe the same issue.

  4. 04

    Validate the grouping

    Check category, scope and mandatory escalation rules, retaining conflicting evidence for operator review.

  5. 05

    Route the incident work

    A separate ServiceNow step creates or updates the permitted incident and links every included alert reference.

Control

Human decision and exception path

Human decision

The named operations owner reviews uncertain groups and any proposal that would merge or close existing incidents. Automatic routing, where policy permits it, does not discard alerts or suppress required escalation.

Exception path

  • Weak or conflicting grouping evidence leaves alerts separate for triage.
  • A newly affected resource or different failure window triggers reassessment rather than automatic attachment to an old incident.
  • Unavailable AWS or incident context marks the grouping incomplete and preserves the original alert handling path.

Evidence

What gets audited

  • Original alert identifiers, resource scope and time window.
  • Exact-duplicate rules and model grouping rationale.
  • Included and excluded alert references with operator decisions.
  • ServiceNow incident creation or update responses.

Nexus runs on premises, in private or sovereign cloud, or air-gapped. Credentials stay in the vault, roles decide who can approve, and the execution record stays inside your deployment boundary.

Sovereignty and deployment

Related

Patterns, connectors and next steps

FAQ

Questions about this use case

Does Nexus replace any of these systems?
No. Each system keeps its own records. Nexus runs the process between them and records each decision.
How does the run start?
An AWS alert set or an updated ServiceNow incident enters the configured operations-triage process.
What if a step is not covered by a pre-built action?
AWS pre-built actions cover EC2, S3, IAM and Lambda. Other event or monitoring reads use authorized AWS APIs or Rules + Code in the same workflow. The model step runs against the AI provider you choose, including Anthropic, Google Gemini or a model you host yourself. Anything outside a pre-built action runs through an API, protocol or database call, or as Rules + Code in Python, Bash, Go, Java, .NET, PHP, PowerShell or JavaScript/TypeScript, with the same approvals and audit.
Are alerts deleted after they are grouped?
No; grouping links evidence to an incident, while source retention remains governed by the monitoring system.

Use case review

Discuss this use case

Bring your version of the process. We will map the systems, approvals and evidence it needs.

Discuss this use case Book a demo