Triage the Queue with an AI Agent: Halo Service Desk Data and the CData API Profile

Every morning, service desk teams review tickets for SLA risks, identify unassigned requests, find relevant knowledge base articles, and route tickets to the right teams. These tasks require attention and judgment but involve repetitive work that AI agents can help manage when they have access to the relevant data.

The Halo Service Desk profile for the CData API Driver gives an agent that access. The profile exposes Halo's tickets, knowledge base, teams, agents, assets, clients, and contracts as read-only SQL tables that any agent, BI tool, or application can interact with. What follows is a real triage run against a live HaloITSM instance: the queries, the reasoning, and the briefing the agent produced.

Why service desk triage suits an AI agent

Triage is a reading and matching exercise. To do it well, an agent or a person has to:

• Rank the queue: weigh priority, ticket type, SLA deadlines, on-hold status, and who, if anyone, owns each ticket.
• Match tickets to known fixes: compare each ticket's summary and details with the knowledge base and recognize when an article already covers it.
• Spot patterns: notice when several tickets across different teams describe the same underlying fault.
• Route correctly: apply the team's assignment rules, which often live in a document rather than in the system's configuration.

All of that information is in Halo, spread across tickets, knowledge base articles, statuses, priorities, teams, and agents. Halo's REST API exposes it, but an agent gets much further with a small set of well-described tables and a query language it already knows.

The CData API Driver and the Halo Service Desk API Profile

The CData API Driver provides SQL access to a catalog of hundreds of APIs and services through API Profiles: small files that define a service's tables and columns, how to authenticate, and how to page through its API. Point the driver's Profile property at a profile file and set its connection properties. The driver handles authentication, paging, and query pushdown, and supports SQL-92 queries with joins, subqueries, and aggregates.

The API Driver is available in the same editions as other CData drivers: JDBC, ODBC, ADO.NET, and Python, plus BI and ETL integrations. The examples below use the CData JDBC Driver for API.

Connecting to Halo

The profile authenticates with a Halo API key. Create or find API keys in Halo under Administration. Select Integrations, and then choose Halo API.

Profile=C:\profiles\HaloServiceDesk.apip;AuthScheme=APIKey;ProfileSettings='APIKey=<halo_api_key>;Domain=yourcompany.haloitsm.com';

The connection sees what the API key's Halo account is allowed to see, so the key's permissions decide what an agent can read.

The data model

The profile exposes 19 tables:

• Tickets is the heart of the profile. Each ticket carries its summary and full details, a category path such as Hardware > Docking Station > Not Working, its status, priority, urgency, and impact, ticket type, team and agent, the reporting user and site, and SLA fields including SlaState, RespondByDate, ResponseDate, and FixByDate.
• KBArticles holds the knowledge base, with each article's name, description, and resolution.
• Status, Priority, TicketType, Teams, and Agents turn the IDs on a ticket into meaning: which status is On-Hold, which priority is Critical and what its response and fix targets are, which team a ticket type defaults to, and which agents belong to which team.

A start-of-day triage

The profile was connected to a HaloITSM instance containing a realistic IT service desk queue, with tickets covering hardware faults, software requests, phishing reports, access requests, and HR system issues. These tickets were distributed across teams including 1st Line Support, 2nd Line Support, Infrastructure, Facilities, Payroll, and HR.

An AI agent using the CData CLI, which provides command line access to data through CData drivers, was then given the following request from a service desk lead:

Triage our open service desk queue for me. What needs attention first, which tickets can be resolved with an existing knowledge base article, which tickets look like the same underlying problem, and which team should own anything that looks misrouted or unassigned?

In 12 commands, the agent worked through the queue the way an experienced team lead would.

Learned the schema: it listed the Tickets columns, then pulled the queue with just the fields it needed like summary, details, category, status, priority, type, team, agent, SLA dates and state, on-hold flag, and matched knowledge base article.

SELECT [Id], [Summary], [Details], [StatusId], [PriorityId], [TicketTypeId], [Team], [AgentId],
[Category1], [SlaState], [RespondByDate], [ResponseDate], [FixByDate], [IsOnHold], [MatchedKbId]
FROM [Tickets]

Decoded the IDs: it read Status, Priority, TicketType, Teams, and Agents to learn which status is On Hold, which priority is Critical, which team each ticket type defaults to, and that agent ID 1 means Unassigned.

SELECT [PriorityId], [Name], [SLAId], [FixTime], [FixUnits], [ResponseTime], [ResponseUnits]
FROM [Priority] ORDER BY [SLAId], [PriorityId]

Read the knowledge base: it scanned all article names and descriptions, then pulled the full text of the articles that looked relevant, including one the team had written for people: "Team Assignment Rules."

SELECT [Id], [Name], [Description], [Resolution]
FROM [KBArticles] WHERE [Id] IN (23, 27, 33, 39, 43, 44, 46)

Reasoned across all of it to produce the briefing below.

Triage results

Here's an edited version of the agent's answer, with names replaced by roles.

Queue snapshot. 29 live service tickets, 21 with no agent assigned. Everything open is within SLA; the earliest fix-by deadline is in two days.

Deal with these first

• #3951: an email impersonating the chief executive asking for an urgent payment. High priority, but on hold for 10 days. An earlier phishing report in the same campaign involved a user entering their password. Take it off hold, confirm no payment was made, block the sender, and check who else received it.
• #3974: emails to one client keep bouncing. The only Critical ticket in the queue. It's with 2nd Line Support but unassigned. Assign it to the 2nd Line engineer.
• #3987: a desktop that blue-screens on every start-up. High priority and unassigned, with the user unable to work.
• #3982: a monthly reporting query timing out. High priority and sitting unassigned with 1st Line, but it's a database performance issue. Route it to Infrastructure.

Already answered in the knowledge base. Six open tickets match five existing articles: laptop slowness, a phone stuck applying company policies (the mobile enrollment article), a password reset, low printer toner, and two software installation requests. Halo hasn't linked an article to any of them yet. Three other tickets only partly match an article and shouldn't be closed on it.

Same underlying problem

• Docking stations: three open tickets (peripherals dropping on dock, Ethernet through the dock cutting out, display layout resetting) plus three closed ones since May, spread across four teams. Worth raising a single Problem record.
• Phishing campaign: five reports in the same category, which is why #3951 shouldn't wait.
• Mobile enrollment: one open ticket and six closed ones with the same failure modes, all covered by the same article.
• Possible links to check: two HR system access issues, and two Salesforce issues that both started recently "with nothing changed."

Routing fixes, based on the Team Assignment Rules article. About 10 tickets sit with the wrong team. Facilities "does not handle any IT-related work," yet it holds a docking-station fault and a mouse replacement, and Payroll holds an application crash and a CRM sync failure, neither of which affects what anyone is paid. Each is listed with the team the rules point to.

What made it work

Context beyond the ticket. The most useful routing advice didn't come from ticket fields. It came from a knowledge base article written for people, which the agent could read through the same connection as the tickets.

Codes it could decode. Status, priority, ticket type, team, and agent tables turned a page of IDs into On-Hold, Critical, Unassigned, and Facilities.

The tech stack

Get CData API Driver

A service desk's queue, knowledge base, and team rules hold everything needed to triage it well, but pulling them together takes time every day. The Halo Service Desk API Profile makes that data available as SQL tables on the CData API Driver, so an AI agent can rank the queue, match tickets to existing fixes, spot recurring problems, and suggest the right owner, and then hand a briefing to a person to act on. The same tables also support SLA dashboards in BI tools and replication of ticket history with CData Sync.

The profile works across all CData editions. Download the CData API Driver, add the Halo Service Desk profile, connect it with a Halo API key, and run your first query against Tickets.