AI Diagnostics is Eido AI working a service desk ticket for you. When a new ServiceNow incident arrives, Eido AI reads it, decides whether it is a problem with a device, and, if it is, investigates on that device through the Eido Client. It then writes up a suspected root cause with a confidence figure, the evidence it gathered, and sometimes a fix it suggests.
It is under Eido AI in the sidebar, as Diagnostics. Anybody who can sign in can read the investigations for the tenants they are allowed to see, pause one, give it guidance and ask it questions. Approving or turning down a suggested fix needs an instance-level administrator.
How an investigation starts#
Nobody presses a button. Eido AI looks at each new incident once, as it arrives from ServiceNow, and opens an investigation when all of these are true:
- The ticket reads like a device problem, such as an application failing, a slow machine, printing, or a connection problem on the device. Password resets, access requests and licence requests are left alone.
- The caller’s email address matches a user Eido knows from your directory.
- Eido AI can tell which of that user’s devices the ticket is about. Only devices where they are the primary user are considered.
- The ticket is still open.
- That device has the Eido Client installed and enrolled.
If any of these fails, there is no investigation and nothing appears in the list for that ticket.
Tickets that were already in ServiceNow when the connector was first switched on are imported as history only. They are never investigated.
What Eido AI looks at#
An investigation is tied to one device. It cannot look at any other.
| Source | What is used |
|---|---|
| The ticket | Its number, state, category, short description and description, the caller, and the most recent comments, work notes and emails on it. |
| The user | The matched user’s name, sign-in name, email address and Windows account identifier, so that checks can be aimed at the right account on the device. |
| The device, live | Through the Eido Client: Intune Doctor, the event logs, running processes, services, registry values, drive and folder listings, network tests (ping, DNS and open connections) and print queues. All of these read. None of them changes anything. |
| Diagnostic scripts | Read-only PowerShell from your script library, and only scripts an administrator has approved. See Approve a script. |
| What Eido already knows | Recent Intune changes that reach this user, and the known issues library. |
Two switches on the tenant decide how much of this is available. The live tools are the ones turned on for that tenant under Eido Client, Tools, in tenant settings. Scripts additionally need AI Diagnostic Scripts switched on in the same place, which is off by default. With it off, the investigation carries on with the live tools alone.
The ticket text, the user and device details above, and the result of every check are sent to the AI model so that it can reason about them. Everything it asked for and everything it got back is kept in the investigation, where you can read it.
The list#
The list shows the newest investigation first and refreshes itself every 15 seconds, so a running investigation moves on without reloading the page.
| Column | What it shows |
|---|---|
| Customer | The customer the tenant belongs to. Shown only if you manage several customers and have not picked one. |
| Ticket | The incident number. |
| Description | The ticket’s short description. |
| User | The caller. |
| Device | The device being investigated. |
| Status | Where the investigation has got to. See below. |
| Root Cause | The suspected root cause, once there is one. |
| Confidence | How sure Eido AI is of that root cause, from 0 to 100. |
| Fix Suggested | Whether a fix has been suggested and is still waiting for somebody to decide. |
| Intune Tenant | The tenant the device is in. |
| Started | When the investigation began. |
Remediation Approved is available as an extra column.
The search box finds a ticket by its number. You can filter on Status, Device, User, Ticket, Confidence (at least a value), Started and, with several customers, Customer. Export as CSV downloads the list as filtered.
Statuses#
| Status | Colour | Meaning |
|---|---|---|
| Running | Blue, spinning | Eido AI is investigating. |
| Waiting for Device | Blue, spinning | The device is offline or did not answer. The investigation picks up by itself when the device checks in. |
| Waiting for Script | Blue, spinning | A script is running on the device. The result is collected automatically. |
| Waiting for Approval | Blue, spinning | The investigation has stopped part-way and is waiting for a person. |
| Paused | Amber | Somebody paused it. It stays paused until somebody resumes it. |
| Pending Approval | Blue, spinning | The investigation has finished and suggested a fix. Nobody has approved or turned it down yet. |
| Remediated | Green, double tick | The investigation finished and a fix was approved and run. |
| Diagnosed | Green, tick | The investigation finished. There was no fix to apply, or the suggestion was turned down. |
| Failed | Red | The investigation could not be completed. The Root Cause column says why when Eido knows. |
| Abandoned | Red | It waited 48 hours, for a device, a script or a person, and was given up. |
Remediated means the fix ran, not that it worked. Open the investigation to see whether the script completed and what Eido AI found when it checked afterwards.
Read an investigation#
Press a row. The investigation opens over the list, titled AI Diagnostics with the ticket number.
Under the title are the device (press it for Device details), whether the Eido Client on it is Online or Offline, a ServiceNow button that opens the incident, the tenant, and when the investigation started. A client counts as online when it has checked in within the last 15 minutes. Hover over the status to see when it last did.
There are three tabs. The icon on Diagnostics and Resolution shows the state of that stage: spinning while it is in progress, an amber pause, a green tick when done, a red cross if it failed.
Ticket info#
The ticket as ServiceNow has it: number, state and priority, the short description, the full description (Show more if it is long), and the Caller, Opened and Category. Priority 1 is shown in red and priority 2 in amber.
Diagnostics#
The evidence trail, oldest at the top. It opens at the bottom, on the newest step, and stays there as steps arrive. Scroll up and it stops following, so that you can read.
- Notes are Eido AI saying what it thinks so far and what it is about to check.
- Checks are one row each, named after the tool, or Script and the script’s name. A row carries how long it took, when it ran, the failure if it failed, and approved by and a name if a person approved it. While a check is still going it reads Running on the device… or Waiting for the device….
- Interjections are guidance a person added, with their name and the time.
Press a check to open it:
| Section | What it shows |
|---|---|
| Why this ran | Eido AI’s own reason, taken from the note just before it. |
| How it ran | Each attempt with its time and result. A long script shows Dispatched to the device; still running, then Checked again: still running, then Completed. |
| Arguments | Exactly what was asked for. |
| Result | Exactly what came back. A very large result is marked as trimmed: the stored copy is shortened, though Eido AI saw all of it. |
Resolution#
Outcome has the Suspected root cause, a summary of the evidence, and the confidence as a coloured figure:
| Confidence | Colour |
|---|---|
| 70% or more | Green |
| 40% to 69% | Amber |
| Below 40% | Red |
If a summary was posted back to the ticket, it says Summary posted to the ServiceNow ticket as a work note. The work note holds the root cause, the confidence, the summary and a link back to this investigation. Eido never changes the ticket’s state or any other field.
Below that are Remediation, when a fix was suggested, and Ask this investigation.
Steer an investigation that is running#
While an investigation is running, a banner above the tabs says what it is doing, and has a Pause button.
-
Press Pause
The banner changes to Pause requested. The investigation stops at its next step. It finishes the check it is on first.
-
Type your guidance
Once it is paused, a box appears: Investigation paused. Add guidance below, then resume. Write what you know, for example “check the firewall rules first”, and press Send guidance. You can send more than one.
-
Press Resume investigation
Eido AI reads your guidance and carries on. What you wrote stays in the evidence trail with your name on it.
A paused investigation does not resume by itself. One left paused for 48 hours is abandoned.
Approve or turn down a suggested fix#
A fix is always a remediation script from your library that an administrator has already approved. Eido AI chooses one. It never writes its own.
When the investigation ends with a suggestion, the Remediation card names the script and shows Awaiting approval. Deciding needs an instance-level administrator.
Approve it#
-
Press Approve & run remediation
-
Confirm it is you
Because this changes a device, Eido asks you to prove it is really you, unless you have done so recently. Press Confirm, and a small Microsoft sign-in window opens. Sign in there. You stay on the same page, and Identity confirmed appears when it is done. See Confirming it is you before a sensitive action.
-
Watch it run
The investigation goes back to Running. The script runs on the device, then Eido AI checks whether the problem has gone and updates the report.
The card follows the script: Starting, Running, then Completed with the time, or Failed. It also says who approved it.
If the sign-in window does not open, your browser has blocked the pop-up. Allow pop-ups for Eido and press the button again.
Turn it down#
Press Mark as bad suggestion, choose a Reason and, if you like, add Detail such as what the fix should have been. Then press Reject suggestion. The reasons are:
- Wrong root cause
- Wrong script for this issue
- Too risky to run
- Issue already resolved
- Other
Nothing runs on the device. The card then reads Marked as bad suggestion with your name and reason, and the investigation shows as Diagnosed in the list.
When fixes run without waiting#
An administrator can set Eido AI to run a fix by itself. It does so only when the confidence is at or above the threshold they chose and that particular script allows it. Otherwise the suggestion waits for a person, as above. See Remediation mode.
An investigation that had to be cut short never runs a fix by itself.
Ask about a finished investigation#
On an investigation that has finished or failed, Ask this investigation takes a question about anything in the record, such as “why was the firewall ruled out?”. The answer is drawn from the evidence already gathered. Nothing more is run on the device, and the root cause is never changed.
Questions and answers are kept on the investigation with the asker’s name and the time, and everybody who opens it sees them.
Finding past investigations#
Every investigation stays in the list. To find the ones for a device, open Device details and look under Eido AI:
- AI Diagnostics lists that device’s investigations. Press one to open it.
- Script Runs lists every script Eido AI ran on the device: the script, whether it was diagnostic or remediation, what triggered it (AI Agent, Technician Approved or Auto-Run), who approved it, the parameters it was given and how it ended.
The link in a ServiceNow work note opens the same investigation directly.
Common questions#
Why is there no investigation for a ticket?#
One of the conditions in How an investigation starts was not met. The usual reasons are that the caller’s email address matches nobody in your directory, the user has more than one device and the ticket does not say which, the device has no Eido Client, or the ticket was resolved before Eido AI read it. A ticket that has been waiting more than a week without being read is skipped.
Why does the status say Waiting for Device?#
The device is off, asleep or off the network. The header shows the Eido Client as Offline. Nothing needs doing: the investigation resumes when the device checks in, and is abandoned if it has not within 48 hours.
Why does the root cause begin “Investigation cut short”?#
Each investigation has a limit on how much work it may do. When it reaches the limit before it is sure, it reports its best answer so far and says so at the start of the root cause. The confidence of such an answer is never shown above 60%.
Why does it say “Not investigated: this instance has reached its Eido AI spend limit for the month”?#
Your organisation has a monthly limit on Eido AI use, and it has been reached. New investigations are not started until the limit resets at the start of next month. An investigation already under way is allowed to finish. Contact support if you need the limit raised.
Why did Approve & run remediation fail?#
Approval failed. You may not have permission, or the session state changed. means either that you are not an instance-level administrator, or that somebody else decided while you had the investigation open. Close it and open it again to see where it stands.
Why did Eido AI not use a script I expected?#
Either the script is not approved, it changed after it was approved and needs approving again, or AI Diagnostic Scripts is switched off for that tenant. See Eido AI.