SLS DataAgent (formerly Intelligent Q&A Assistant)

1. Log on to the Log Service console.

2. Choose Log Apps > SLS DataAgent, and then click Digital Employee.

3. On the digital employee page, click Create Digital Employee in the upper-right corner.

4. In the Create Digital Employee dialog box, configure the following parameters:

   Parameter	Required	Description
   ID	Yes	The unique identifier for the digital employee. This ID cannot be changed after it is created. We recommend using a combination of letters and numbers, such as order-system-expert.
   Display name	Yes	The name displayed for the digital employee in the UI. We recommend using a name that reflects its business purpose, such as "Order System Monitoring Expert" or "Big Data Cluster Inspector".
   RAM role type	Yes	Specifies the type of RAM role for the digital employee. You can select one of the following options: • service role: Use the system-provided service role (no configuration required). The digital employee automatically obtains read permissions for Log Service and ARMS. • custom role: Select this option if you need to access a specific Model Studio knowledge base or restrict the access scope. You must configure an authorized RAM role ARN. For more information, see Create and authorize a RAM role.
   RAM role ARN	Yes	This parameter is required only if you select a custom role. The default service role uses the ServiceRoleForCloudMonitor role, which has read permissions for CloudMonitor, Log Service (SLS), and ARMS.
   Built-in SLS knowledge base	No	If enabled, the digital employee answers questions related to SLS. This is enabled by default.
   Description	No	Describe the digital employee's responsibilities and capabilities. For example: "Responsible for daily inspection, anomaly analysis, and root cause analysis for core applications in the order center. Capable of analyzing slow MySQL queries."
   Default rules	No	Default rules to guide the digital employee's behavior. We recommend using Markdown syntax. You can define the employee's role, scope of capabilities, and behavioral guidelines.

5. After you configure the parameters, click OK.

SOP knowledge base structure

The SOP knowledge base uses a modular, directory-based structure with SOP.md as the core entry file. This structure allows the agent to autonomously find the information it needs.

The following is a recommended directory structure: accesslog_sop .zip

knowledge_base_root/
├── SOP.md                  # Core entry file, describes the overview of each knowledge domain
├── accesslog/              # Access log domain
│   ├── overview.md         # Domain overview
│   └── troubleshooting.md  # Troubleshooting guide
├── monitoring/             # Monitoring domain
│   ├── overview.md
│   └── alert-handling.md
└── ...

In SOP.md, provide an overview of each knowledge domain, and then provide detailed information in the corresponding files within each directory.

Associate the built-in SLS knowledge base

The built-in SLS knowledge base contains standard operating procedures and best practices for Log Service, which helps answer SLS-related questions.

Method 1: Enable during creation

When you create the digital employee, keep the Built-in SLS knowledge base switch enabled.

Method 2: Add after creation

1. In the digital employee list, click the target digital employee to open its details page.

2. Select the Knowledge base tab.

3. Click Add Knowledge Base and select the Built-in knowledge base type.

4. In the Knowledge base ID field, enter sls and click OK.

Associate an OSS knowledge base

If your SOP documents are stored in OSS, follow these steps to associate an OSS knowledge base.

Prerequisites

• You have created an OSS bucket and uploaded your SOP documents.

• You have created and configured a custom RAM role. For details, see Create and authorize a RAM role.

Procedure

1. Change the RAM role type of the digital employee to Custom role and configure the authorized RAM role ARN.

2. On the digital employee details page, select the Knowledge base tab.

3. Click Add Knowledge Base and select the OSS knowledge base type.

4. Configure the following parameters:

   Parameter	Description
   OSS region	The region where the OSS bucket that stores the SOP documents is located.
   OSS bucket	The name of the OSS bucket.
   Document library root path	The directory path where the SOP.md file is located. If SOP.md is in the root directory of the bucket, enter /. If it is in a subdirectory, enter the full path, such as /docs/sop/.

5. Click OK.

Associate an Alibaba Cloud DevOps knowledge base

If you use Alibaba Cloud DevOps (Codeup) to manage your SOP documents, follow these steps to associate an Alibaba Cloud DevOps knowledge base.

Prerequisites

• You have created a code repository in the Alibaba Cloud DevOps console and uploaded your SOP documents.

• You have created a personal access token.

Obtain configuration information

1. Organization ID: You can find the organization ID in the page URL. The URL is in the format https://codeup.aliyun.com/<Organization_ID>/<Repository_Name>\.

2. Repository ID: On the code repository page, choose Settings > Basic Information to view the ID.

3. Personal access token:

   • In the Alibaba Cloud DevOps console, click your profile picture in the upper-right corner and select Personal settings.

   • Choose Personal access tokens and click Create Access Token.

   • Set a name, expiration date, and permission scope for the token, and then click Create.

   • Copy and securely save the generated token. The token is displayed only once.

Procedure

1. On the digital employee details page, select the Knowledge base tab.

2. Click Add Knowledge Base and select the Alibaba Cloud DevOps knowledge base type.

3. Configure the following parameters:

   Parameter	Description
   Organization ID	The ID of your Alibaba Cloud DevOps organization.
   Repository ID	The ID of your code repository.
   Branch name	The branch to associate, such as master or main.
   Personal access token	Your Alibaba Cloud DevOps personal access token.
   Document library root path	The directory path where the SOP.md file is located.

4. Click OK.

Grant permissions to a RAM user

To use SLS DataAgent as a RAM user, an administrator must first grant you the necessary permissions.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ram:PassRole",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "acs:Service": "cloudmonitor.aliyuncs.com"
        }
      }
    }
  ]
}

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:CreateThread",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads"
      ],
      "Resource": "acs:cms:*:*:digitalEmployee/*"
    }
  ]
}

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cms:CreateChat",
        "cms:GetDigitalEmployee",
        "cms:ListDigitalEmployees",
        "cms:GetThread",
        "cms:GetThreadData",
        "cms:ListThreads",
        "cms:CreateDigitalEmployee",
        "cms:UpdateDigitalEmployee",
        "cms:DeleteDigitalEmployee",
        "cms:CreateThread",
        "cms:UpdateThread",
        "cms:DeleteThread"
      ],
      "Resource": [
        "acs:cms:*:*:digitalemployee/*",
        "acs:cms:*:*:digitalemployee/*/thread/*"
      ]
    }
  ]
}

Create and authorize a RAM role

If you need to use a custom role, such as for accessing an OSS knowledge base, follow these steps to create and authorize a RAM role.

Step 1: Create a RAM role

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Roles.

3. Click Create Role and select Alibaba Cloud Service as the trusted entity type.

4. Configure the following information:

   • Role name: Enter a custom name for the role.

   • Select trusted service: Select CloudMonitor/Cms.

5. Click Complete.

Step 2: Authorize the RAM role

1. Create a custom permission policy. The following policy grants read permissions for OSS and Log Service:

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "oss:GetObject",
        "oss:GetObjectAcl",
        "oss:ListObjects",
        "oss:ListObjectVersions"
      ],
      "Resource": [
        "acs:oss:*:*:<OSS_BUCKET_NAME>",
        "acs:oss:*:*:<OSS_BUCKET_NAME>/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "log:Get*",
        "log:List*"
      ],
      "Resource": "*"
    }
  ]
}

Note: Replace <OSS_BUCKET_NAME> with the actual name of your OSS bucket.

2. Attach the custom permission policy that you created to the RAM role.