Investigation and Diagnosis is a tricky one and often requires an SME. Using monitoring to open Incidents is of course better than waiting for a customer to open a case. If you always knew exactly what to look for beforehand the mechanism can work quite well. The reality is that it can be very difficult to know what to look for - creating rules to look for known conditions literally means project and human resource cost. This is the sweet spot where AIOps comes in.

Have you ever opened a case? What's the first thing support asks for? The logs! They need them to eventually start diagnostics.

The ServiceNow AIOps platform can automate diagnostic routines on your behalf by correlating log anomalies from disparate systems. These log anomalies are then correlated with other signals like Metrics, Events and Tasks to complete diagnostics so that you can begin resolution and recovery. It is root cause analysis when you did not know what to look for beforehand. Ash Poxon @ https://www.nationalgrid.com/ wrote about this recently - have a look at his post on LinkedIn. He gives a great explanation on how ServiceNow AIOps provides a massive reduction in time to get to resolution and recovery.

Short story is that ServiceNow AIOps automates Incident Response instead of just automating Incident Identification. AIOps transforms the Incident process with Machine Learning to identify Root Cause before Incidents are opened. Tracking "just is" in the ServiceNow platform and the data you need for related KPI reporting is already there. The KPI reports are actually there too. Time to take advantage of information driven outcomes.