A new tech's first month is spent discovering, one awkward question at a time, what the team already knows: which tickets dominate, which systems are quirky, who owns what. The raw material for a proper onboarding pack sits in your ticket history and KB — an LLM can assemble it in an afternoon.
Tier: Foundation · Workflow area: Knowledge management · ~25 minutes per pack
This playbook generates a three-part enablement pack from exports you already have — a "top 20 tickets in this account" brief, an environment cheat-sheet, and a first-two-weeks guide — then routes it past a senior tech for the correction pass that turns generated text into trusted onboarding.
Export twelve months of resolved tickets for the scope. Subject, category, resolution notes (first lines), count-relevant fields. Volume matters more than detail — you want frequency signal.
# From a CSV export: top categories by volume, quick sanity view
Import-Csv .\tickets-12mo.csv |
Group-Object category |
Sort-Object Count -Descending |
Select-Object -First 20 Name, Count
Generate the "top 20 tickets in this account" brief.
From this 12-month resolved-ticket export, produce a "top 20 issues"
onboarding brief for a technician new to this queue.
For each of the 20 most frequent distinct issues:
- Issue name in user vocabulary + rough monthly volume
- Typical cause (only if the resolution notes support it)
- Standard fix in 2–4 steps, citing the KB article ID when a note
references one
- Gotcha: anything the notes show techs getting wrong repeatedly
Rules: group true duplicates (password reset variants = one issue);
write "cause varies — see linked articles" rather than inventing a
single cause; mark low-confidence entries [SENIOR CHECK].
Export: [paste]
Generate the environment cheat-sheet from your systems docs. Feed it the current-state facts only you can supply — tenant names, RMM, ITSM, VPN, key servers, admin portals — and ask for a one-page cheat-sheet: system | what it is | URL | how you get access | who owns it. The model formats and normalizes; the facts come from you, because this is exactly where hallucinated URLs and wrong owner names would otherwise creep in.
Generate the first-two-weeks guide. Prompt with your team's actual expectations: day-1 access checklist, which queues to watch first, the shadowing plan, "questions we expect you to ask", escalation etiquette, and where the KB, prompt library and handover channel live. Ask for it structured as a checklist the starter ticks off — checklists get used; prose gets skimmed.
Run the senior-tech correction pass. A senior reviews all three artifacts against reality: every [SENIOR CHECK] resolved, every URL and owner verified, the gotchas confirmed or cut. Sample correction worth its weight:
Top-20 item 7 (VPN cert errors): fix steps correct BUT only for the
AnyConnect profile — the sales team is on GlobalProtect, different
procedure, KB0004412. Added split by team.
Twenty minutes of senior time; it converts the pack from plausible to trustworthy.
Deliver as living documents. Pack goes where the team already reads (wiki/KB section, not email attachments), each artifact carries an owner and a review-by date, and the new starter's standing assignment is to flag everything that turned out wrong or missing — the freshest possible QA.
Refresh on trigger, not schedule alone. Re-run step 2 when the ticket mix shifts (new rollout, migration), and diff the new top-20 against the old — the diff itself is useful team news.
Ticket exports and environment sheets are a map of your organization's soft spots — strip user identifiers before external assistants, and treat the finished cheat-sheet (URLs, system owners, access paths) as internal-confidential.
The knowledge a new starter needs already exists in your ticket history — the model extracts and shapes it, the senior pass makes it true, and the starter's own corrections keep it alive for the next hire.