AI Agents for Ops – Automated Incident Response (AIOPS)

AI - Artificial Intelligence, AI for Professions

In this practical hands-on course (30% theory, 70% practice) you will learn to apply multi-agent AI systems for automated incident investigation and automated resolution in IT operations. Sessions run in a prepared Linux lab, with emphasis on security and cost control.

This course explains agent architecture and the observe/decide/act loop, plus the subagent pattern to reduce blast radius and costs. You will run agent teams, design MCP safety boundaries, execute layered simulated incidents, plus production patterns for logging and escalation.

THIS TRAINING COURSE WILL HELP YOU:

  • Understand AI agents and how they differ from chat or scripts
  • Assemble an AI agent team for incident investigation
  • Use agents safely so they cannot perform unauthorized actions
  • Decide when an agent is appropriate vs script or monitoring

WHO SHOULD ATTEND?

  • Ops, DevOps, and SRE engineers wanting practical agent skills
  • Platform and infrastructure engineers evaluating agent deployment
  • Engineers working with infrastructure who want multi-agent Ops patterns
  • Not for developers focused on AI coding workflows
  • Not for data scientists or ML engineers — different discipline

COURSE LOCATION AND AVAILABLE DATES



Choose whether to attend in person in our classroom or join online. You can select your preferred format during registration. Learn more about hybrid training.
Praha + online (optional)
Private training

Unlock your employees' potential. We can adapt every course in our portfolio to your objectives and participants.
Need training at your premises or want to tailor the content and duration? We will prepare the right solution, in Czech or English.

Request customised training

Course content:

Hide details
  • Module 1 — Agent architecture for Ops
    1. Intro: what LLMs do, what chat can and cannot do
    2. What is an agent: observe / decide / act loop; difference from chat (tools + autonomy)
    3. When NOT to use an agent: scriptable tasks, deterministic processes
    4. Subagent pattern: why not one big agent — blast radius, costs, focused context
    5. Three roles: coordinator (strong model), syscheck + logcheck (cheaper models)
    6. Hands-on: build a coordinator and two specialist agents; run on a simulated alert
  • Module 2 — MCP servers as a safety boundary
    1. Problem from Module 1: agents with full shell access are unacceptable in production
    2. What is an MCP: networked tools, not shell access; like sudo rules — allowed commands only
    3. Two tool types: read-only (investigation) vs write (action)
    4. MCP anatomy: entry point, tool definitions, input/output schema
    5. Hands-on — Method 1: plug an existing syscheck-MCP into a syscheck profile
    6. Hands-on — Method 2: build a logcheck-MCP using a dev-squad (developer + tester + security subagents)
  • Module 3 — Automated investigation
    1. Investigation loop: trigger → investigate → report → (optionally) act
    2. When to stop, when to act, when to escalate
    3. Triggers: polling as a simple start (why start simple, not webhooks)
    4. Live demo: full chain on a prepared incident
    5. Hands-on: connect a trigger, run the full team on a layered real scenario (Disk full → MySQL lock → HTTP 500)
    6. Scenario design: layered checks require coordinator to correlate syscheck + logcheck outputs
  • Module 4 — Production patterns and cost control
    1. Model tiering: coordinator vs workers; real cost numbers for pipeline runs
    2. Failures and mitigations: infinite loops, token burn, hallucinated actions, cascading delegation, stale context
    3. Production checklist: read-only default, human-in-the-loop for write, cost budget, logging, alerting-on-alerting, graceful degradation
    4. When NOT to use agents: deterministic tasks, compliance-critical actions, tasks without an audit trail
Prerequisites:
Basic Linux server skills (SSH, shell, reading logs) and prior LLM chat experience.
Recommended previous course:
Linux – Basic Administration (LNX1)
Schedule:
1 day (9:00-17:00)
Price per person:
316.00 € ( 382.36 € incl. 21% VAT)

Training and learning environment

IT classroom with desks, computer monitors, and a projection screen at the front.
What does the environment for in-person IT courses look like?We hold training courses in our own classrooms equipped with modern computer equipment for each participant and a large projection screen. Each workstation is fitted with a powerful computer for seamless practical exercises, and the environment supports a calm, friendly atmosphere during training.
IT classroom with desks, computer monitors, and a projection screen at the front.
Do I need to bring my own laptop to the classroom IT course?Our training rooms are fully equipped, so you do not need to bring your own laptop. A modern computer with all necessary hardware and software is ready for you at your workstation.
Sample ICT Pro certificate of successful completion of an IT training course.
Will you receive an official certificate after completing an IT course?Yes, upon successful completion of the training course, you will receive an official ICT Pro certificate confirming your participation and acquired technical skills. You can use it to verify your qualifications or add it to your professional profile.
Exterior view of the COMGUARD office building on Sochorova Street in Brno.
Where can you find our training center in Brno?The premises of the ICT Pro training center are located on the 1st floor of the COMGUARD building at Sochorova 38 in Brno. Positioned on the border of Žabovřesky and Komín, the location is easily accessible by both car and public transport.
Exterior view of the Opatov Park office building in Prague, Chodov.
Where can you find our training center in Prague?The premises of the ICT Pro training center are located on the 1st floor of the Opatov Park building at Líbalova 1, Prague 11 – Chodov. The location provides a comfortable environment for your education with convenient access.
Fully equipped kitchenette with a coffee machine, microwave, sink, and shelves with cups and glasses.
What facilities and refreshments are available to you during training breaks?Our training centers feature a fully equipped kitchenette for a comfortable break during your courses. The facilities include a coffee machine, microwave, kettle, and a wide selection of drinks and snacks.
Coffee station featuring an automatic coffee machine, yellow and white cups, glasses, and syrups.
What beverage refreshments are available during your course?A beverage station with a coffee machine, teas, syrups, and water is at your disposal throughout the entire training session. You can enjoy a coffee or another drink of your choice anytime during breaks.
Table with sweet pastries, fruit syrups, a water dispenser, and glasses set up for training participants.
What light refreshments are provided for you during the courses?During course breaks, participants can enjoy light sweet snacks, pastries, and fruit syrups to mix their own drinks. Fresh water dispenser and plates are also available for your convenience.
Wicker baskets filled with packaged savory snacks, sweet biscuits, and snack bars.
Should I bring my own snacks to ICT Pro training?There is no need to. A wide selection of savory snacks, sweet biscuits, and snack bars is available for you during breaks. Boost your energy for all-day focus right inside the training center premises.
Outdoor wooden terrace with green surroundings by the glass building of the training center.
Can you spend training breaks in the fresh air?Yes, an outdoor terrace is available at our training center. During breaks between learning sessions, you can relax in the fresh air in a pleasant green environment.
Spacious outdoor wooden terrace with seating and views of the surrounding area.
Where can you relax during course breaks?Our training center features a spacious outdoor terrace with seating options. During breaks between learning sessions, you can step outside to relax and recharge in the fresh air.