In one embodiment, a server in a network reports one or more symptoms of a monitored device that is malfunctioning to a user interface via a particular chatbot session. The server receives, via the particular chatbot session, a triage request to enter a triage mode regarding the one or more reported symptoms. The server predicts a corrective action using the one or more reported symptoms as input to a machine learning model. The machine learning model is trained using a history of observed symptoms in the network, a history of corrective actions initiated via chatbot sessions and associated with the observed symptoms, and a history of feedback regarding the corrective actions received via the chatbot sessions. The server provides the predicted corrective action to the user interface via the particular chatbot session as a suggested corrective action, in response to the received triage request.