CEDX ITSM · IT & Security
CEDX ITSM runs incidents, problems, changes and major incidents off one record. Every row carries an AI-suggested group and a response clock, and when fourteen incidents are really one outage, the Major blast view says so.
The Overview does not hide the bad news: 189 breached, 91 at risk, 50 unassigned — next to the 154 conversations the portal agent deflected today with no human touch. Both numbers are on the same screen.
Runs on demo data — the workspace is the software's Northline sample, not a customer.
What it is
The queue lists 320 incidents with priority, status, group and an AI-suggested assignment on every row — INC-2637 “Wifi controller offline during freeze” comes with P3 · Network at 75% confidence. The wait and response-left columns are honest about it: 15.9h past.
Problems is a library, not a graveyard: 64 problems, 53 open, 27 marked known error with a workaround attached. Recurring noise becomes a systemic record — “KE disk full warning. Systemic” — with the incident count against it.
MI-12 is a SEV-1 auth-gateway outage on the prod edge. The blast view names the commander, the start time and the age, correlates 14 incidents across 8 services and 5 sites, and simulates severity: 98 pre-levers, 76 residual with one lever pulled.
Product tour
Not a mockup and not a concept deck. This is what opens at /app/itsm.
01 — Overview
187 open incidents, 86 of them P1-P2, 91 at SLA risk with breach probability over 55%, and a median P1-P2 age of 16.0 hours. Next to it, the deflection story: 154 handled by the portal agent today, $3.8K of agent handling avoided this week.
02 — Incidents
Filter chips for P1 through P4, New, In progress and On hold sit above the table; search takes an incident number, a CI or a service. The view exports to CSV — the view you were actually looking at, not a report someone else runs.
03 — Problems
64 problems in the library, each with status, priority, owner and the service it keeps hurting — shared storage, analytics, email, the auth gateway. The known-error toggle isolates the 27 with workarounds from the ones still waiting on a root cause.
04 — Major blast
Instead of fourteen assignees discovering the same outage, the commander sees the correlated set: auth gateway 5xx on prod edge, SSO redirects failing for warehouse tablets, login timeouts at the storefront — one blast, one primary incident, one comms channel.
Who runs it
Roles, not references. We have no named customers yet, so nobody in these photographs is quoted, credited or claimed as one.
Works the queue by the response clock, claims the 50 unassigned, and watches the deflection rate to see what the portal agent is actually absorbing.
unassigned · 50
Turns the third “wifi controller offline” incident into a problem record with a workaround, so the fourth one closes itself.
known errors · 27
Runs MI-12 from the blast view: correlated incidents, services hit, comms, and a containment simulation before anything gets pulled.
residual SIM · 76The shape of it
Every figure below is legible in the captures above. Nothing here is a projection of your estate — it is the state of the demo data.
How it runs
The portal agent takes the first conversation — 154 deflected today at a 42% rate — and what it cannot resolve lands in the queue with context attached.
Each incident gets an AI-suggested group with a confidence figure, and the response clock starts. P1-P2 is its own tab, not a filter someone forgot to save.
Recurring symptoms roll up into problems and known errors; a real outage rolls up into a major blast with a named commander and a correlated incident set.
SLA attainment, median age and changes at risk are on the same Overview the team opened at standup — the review is the screen, not a deck built from it.
One record
An incident is only as good as what it knows about the device, the person and the change behind it. That context is what the rest of the estate writes.
The alerts that become incidents — checks down, SLO burn, SEV-1 — are Monitoring's native language, so the queue opens with the signal attached.
CEDX EndpointThe CI column on an incident row is a real device with an exposure score and a patch lag, not a string someone typed.
CEDX AccessA change that touches production goes through the same grant and approval record Access keeps — CHG-915's kernel patch has an approver.
CEDX CopilotAsk AI — the button on every screen — is Copilot, reading the same record the queue is built from.
Limits
Finding this out on the third call is worse for you than reading it here, and worse for us.
Start
Open it right now
Your queue, your services
ITSM with the rest of it
Questions
Yes. Every screenshot is a capture of the running build and you can open the same build at /app/itsm. It runs on demo data — the Northline workspace is the sample tenant.
It takes the first conversation and resolves what it can without a human: 154 deflected today at a 42% deflection rate, against 214 that went to agents. Both numbers are on the Overview, so you can judge the mix yourself.
When correlated incidents point at one cause, the Major blast view groups them: a named commander, a primary incident, the services and sites in blast, comms, and a containment simulation that shows severity before and after each lever — 98 down to 76 on MI-12.
A problem is the record for a recurring or systemic cause; a known error is a problem with a confirmed root cause and a workaround attached. The library holds 64 problems, 27 of them known errors, and “No RCA yet” is its own tab.
No certification has been issued. What we can evidence about hosting, encryption, tenant isolation and production access is written up on the security page.
Live build, demo data, no card. Then compare it with the queue your team worked this morning.