Event-Driven Ansible meets the ticket queue nobody reads
Start with the boring alerts. They pay off fastest.
Everyone wants Event-Driven Ansible to fix outages at 3am. Start smaller.
Find last month's tickets closed with the same three steps every time: a full log volume, a service restart after a cert rotation, a locked shared account.
Those are your first rulebooks. Low risk, easy to measure, and on-call will notice within a week.