Detecting Major Incidents in Snowflake with Embeddings, Clustering, and LLMs

A Snowflake-native pipeline for automatically detecting major incidents from customer support cases is presented. The approach combines text embeddings (via Snowflake Cortex EMBED_TEXT) with DBSCAN clustering and two-stage LLM assistance: first, an LLM gates borderline case-pair similarities to sharpen cluster boundaries; second, another LLM prompt classifies each resulting cluster as a potential major incident or not. The full implementation uses Snowflake SQL, a Snowpark Python UDAF wrapping scikit-learn's DBSCAN, and AI_COMPLETE calls to Claude. In production experiments, the pipeline detected over 70% of incidents once at least three related support cases had been filed, reducing Mean Time To Detect and improving customer experience.