Change Management
Modern IT organizations are executing changes at unprecedented volume and velocity, typically on a daily or weekly basis. The problem is that IT change management processes haven’t scaled with the accelerated speed of software delivery.
AI can process and analyze large volumes of data at a scale beyond the capacity of any human. With BigPanda's change management features, you can pivot from reactive firefighting to predictive prevention as your IT teams have the change intelligence to move faster, safer, and strategically.
BigPanda's Change Management tools analyze historical incident patterns, change records, and affected configuration items (CIs) to deliver clear, explainable risk scores and proactive action plans.
Within the Change Risk Dashboard, view all change requests and their associated risk, predicted by AI Incident Prevention.
Risk score rating frequency
The Change Risk Dashboard assigns a risk score to upcoming changes. The risk score is based on specific change fields and compares the current planned change details with data from your change integrations to identify potential risks.
Changes are typically risk rated every 25-35 minutes, but can take up to an hour depending on the number of changes queued. To request an ad-hoc risk rating, use the Change Risk Analysis API.
The Change Risk Dashboard is divided into two tabs:
Risk Prediction
The Risk Prediction tab displays upcoming change requests and their associated risks.
By default, all changes for the next 30 days appear in the Risk Prediction tab. You can filter the list using Risk Profiles, Date Range, Time Zone, or click Filters to select one or more ServiceNow fields to filter on. Selected ServiceNow fields will appear as dropdowns in the bar below where you can choose specific values.
To find a specific change, use the Search bar. You can search for a change number or keyword.
Click Columns to customize the columns that appear in the changes table. You can choose from default columns, or select ServiceNow fields. Reorder columns by dragging and dropping them.
The following columns appear in the Change Risk table by default:
Change number
Short description
AI Change Summary (Full description)
Assignment group
Scheduled start
Risk rating
Risk score
Filter and column persistence
All filters and column selections persist on a user-level basis. Your selections will not affect other users' view of the dashboard.
When you exit the dashboard or web app, your selections will be retained and appear the next time you access the dashboard using your account.
Export CSV
To download the table, scroll to the bottom of the page and select Export CSV. The exported CSV file contains the following columns:
Change Number
Short Description
AI Change Summary
Assignment Group
Scheduled Start
Risk Rating
Risk Score
Last Assessed
Risk Reasoning
Suggested Mitigations
Change Volume by Risk Level
Below the filters and search bar is the Change Volume by Risk Level graph. This displays the total number of changes over time broken down by risk level.
Hover over a specific day to see the numer of changes in each risk level that occurred on that day.
Change Risk Assessment
Click any change in the dashboard to open the Change Risk Assessment screen.
The Change Risk Assessment screen shows you details about the potential risk associated with the selected change.
The assessment screen is divided into the following tabs:
To send an assessment to an external system, go to the upper right corner of the screen and click the Arrow icon. Assessments can be sent to Email, Slack, MS Teams, or ServiceNow.
Change Details
The Change Details tab displays high-level information about the selected change.
To adjust which ServiceNow fields appear on the screen, select Display Settings. Choose additional fields and click Apply Changes.
The screen is divided into the following sections:
Section | Description |
|---|---|
Change Information | High-level information about the change. The following details are displayed in this section:
If the change requires attention, a red box with an exclamation point will appear describing the requirements. |
AI Risk Assessment | The risk assessment score and risk rating. Click View Details to open the Risk Prediction tab. |
Change Plan | Steps to take to implement the change. |
Justification | Reasoning behind the change plan. |
Test Plan | Steps to take to test after the change to ensure it was successful. |
Backout Plan | Steps that can be taken if the change needs to be reversed. |
User-Declared Risk | The risk level of the change defined by the user who opened it. |
User-Declared Risk Analysis | The risk analysis of the change defined by the user who opened it. |
Approval Information | People who need to review the change before it can be implemented. The following information about each approver is displayed:
|
Affected Services | Services potentially affected by the change. |
Affected CIs | Systems and services that will potentially be affected by this change. The following information about each CI is displayed:
|
Related Change Tasks | Tasks that need to be completed as part of the change. The following information about each task is displayed:
|
Historical Analysis
The Historical Analysis tab displays similar changes and related incidents that were used as part of the change risk profile. These changes and incidents may provide additional context.
The Historical Analysis screen is divided into the following sections:
Section | Description |
|---|---|
CI Risk Analysis | The risk assessment for configuration items affected by this change, based on historical incident data. This information can be displayed in Card View or Table View. The following information appears for each CI:
|
Similar Changes | Changes that are similar in nature or affect the same CIs. A box displaying the change number, description, and date appears for each similar change. Click a box to view additional information including the full description, similarity reasoning, resolution of the incident (if applicable), and linked incidents. |
Additional Relevant Incidents | Incidents that were not linked to a change, but are considered relevant given the nature or affected CIs of the current change. A box displaying the incident number, description, date, and shared CIs appears for each relevant incident. Click a box to view additional information including the full description, similarity reasoning, and resolution of the incident (if applicable). |
Relevant Ancillary Context | Information across all available contexts that was deemed potentially relevant to the current change. |
Team History
The Team History tab shows the historical performance records of the team and the individual responsible for the change.
You can view history by Team Metrics or Individual Metrics.
The Team History screen shows the following information:
Field | Description |
|---|---|
Team | The team name, reliability score, and deployment frequency score. |
Individual | The individual's name, reliability score, and deployment frequency score. |
Total Changes | The total number of changes deployed by the team. This number is based on full historical metrics. |
Incident Rate | The incident rate compared to the number of changes the team was responsible for. This rate is based on full historical metrics. For example, if the team was responsible for 10 changes and 2 of them caused incidents, the incident rate would be 80%. |
Success Rate | The percent of successful changes that the team was responsible for. This rate is based on full historical metrics. For example, if the team was responsible for 10 changes and 2 of them caused incidents, the success rate would be 80%. |
Change Timeline | A timeline of changes over the past 12 months. The blue bars represent changes, the orange bars represent incidents, and the green line represents the change success rate. |
Recent Team/Individual Incidents | The most recent incidents caused by changes the team or individual was responsible for. The following information about each incident is displayed:
|
Organization-Specific Risk Evaluation
The Organization-Specific Risk Evaluation tab displays a custom risk evaluation based on factors and context specific to your organization.
Configuration
To view org-specific risk information, you must configure org-specific settings in the Change Risk Prediction action plan.
The following information is displayed:
Section | Description |
|---|---|
Risk Evaluation Summary | Short summary of the org-specific risk evaluation. |
Org-Specific Risk Assessment | The risk score. |
Evaluation Confidence Level | How confident AI Incident Prevention is in the evaluation. |
Specific Risk Factors | List of specific factors contributing to the risk score. |
Ambiguities | Ambiguous factors related to the change that contribute to the risk score. |
Risk Prediction
The Risk Prediction tab displays widgets containing information about the predicted risk level of the change.
The following widgets are displayed:
Widget | Description |
|---|---|
Risk Prediction | AI-powered risk assessment based on previous changes. The following scores are displayed:
|
Overall Risk Rating | The risk assessment of the change with all factors combined. The date and time of the last assessment appears under the risk rating. To re-assess the risk rating, click Force Re-Rate. |
Risk Reasoning | Explanation of the reasoning behind the risk assessment. |
Risk History | How the change's risk assessment has evolved over time. |
Suggested Mitigations | Suggested steps that can be taken to mitigate risks associated with the change. |
Graph View
The Graph View tab visualizes the relationships between the change, similar changes, and related incidents.
The graph view is coded by color:
Current change - purple
Similar change - purplish blue
Incident - red
Configuration item - blue
Hover over any of the items in the graph to view additional information such as the number, description, and risk level.
To see a larger view, click the Full screen button.
To view a text version of the visualization, click the List View tab.
Real-Time Deconfliction
Use the Real-Time Deconfliction tab to identify conflict-based risks associated with upcoming changes.
By default, Real-Time Deconfliction displays data for the next 8 hours from all change risk profiles. You can filter the dashboard by Risk Profile or Time Range.
Real-Time Deconfliction Signals
AI Incident Prevention analyzes several different incident and change events to look for signals of conflict-based risks. The types of possible signals are:
Active incidents - Open incidents related to affected CIs or business services.
Recent incidents - Incidents resolved in the past 48 hours that may indicate instability.
Change conflicts - Changes affecting the same owner or CIs scheduled near the same time
Failed changes - Changes failed on the same CIs over the past 30 days.
Open problems - Active problem tickets related to affected CIs or business service.
Conflict risk rating is determined by the conflict type and timing proximity:
Conflict type | Overlapping (Concurrent) | Within 4 hours (Near) | Same day (Within 24 hours) |
|---|---|---|---|
Same CI (different owners) | Critical | High | Medium |
Same owner and same CI | High | Medium | Low |
Same owner only | Medium | Low | High |
Signal refresh
When you open the Real-Time Awareness tab, signals are refreshed and then cached for the session. You can also use the Refresh button at the top of the page to manually refresh.
Each signal includes detailed metadata and links to ServiceNow records when available.
Change Information
If a change has one or more real-time risk signals, it will appear on the dashboard. Each of these changes lists the following details:
Field | Description |
|---|---|
Change Number | Unique identifier of the change. |
Scheduled Start | Date and time when the change is scheduled to begin. |
Risk Rating | Projected risk level associated with the change. |
Assigned To | Person to whom the change is assigned. |
Signals | Number of real-time signals identified that contributed to the risk rating. |
Confliction Score | Score associated with the conflict. Higher scores indicate more conflicts. The highest possible score is 100. |
Click any change in the list to view the Deconfliction Assessment.
Deconfliction Assessment
The Deconfliction Assessment displays conflict details to help you avoid any potential risks.
At the top left side of the assessment, the number of Concurrent, Near (within 4 hours), and Same Day changes appears. At the top right side, the Conflict Score is available.
The assessment is divided into the following sections:
Section | Description |
|---|---|
Timeline Visualization | Timeline of conflicting changes over the next 24 hours. Concurrent change windows are red, changes within 4 hours are orange, and same-day changes are yellow. |
Risk Signals Detected | Details about each of the risk signals that contributed to the conflict. Information such as signal type, conflict type, change proximity, and other details are displayed. |
Change Details | Information about the assessed change. Click the change number at the top of the section to open it in ServiceNow. Click the link below the change number to open the full change risk assessment. The Change Details section contains the following information:
|
Root Cause Changes (RCC) dramatically speeds up the process of identifying the changes that cause outages and incidents in your systems.
RCC leverages existing incident and change data in a weighted vector algorithm to identify the connections between alerts and change data and surface suspected root cause changes.
For organizations leveraging BigPanda's AIA, RCC-X uses LLM to take this connection deeper, then provides an in depth analysis and causality evaluation to accelerate root cause investigation.
The Changes Tab
BigPanda analyzes each change against active existing incidents in real-time, so your teams don’t have to manually dig through hundreds or thousands of potentially related change events. Changes that are suspected as a potential root cause are flagged and added to the incident.
By integrating your CI/CD and change management tools with BigPanda, you can normalize and aggregate change data alongside incidents. This comprehensive enrichment gives you deep insights into the changes that may have triggered an issue.
BigPanda University Advanced Insight Module course
Learn more in the BigPanda University Advanced Insight Module course.
By the end of the course you will be able to:
Generate and review AI Analysis reports for your incidents that will help you reduce MTTR.
Review root cause change suspects and identify changes that are the root cause of incidents.
Compare incidents with similar characteristics to enhance context and resolve incidents faster.
Click here to enroll.
Key Features
Connect a variety of change tools to BigPanda using standard and custom integrations.
View changes that occurred prior to and during an incident to easily identify changes that may have been related to the incident.
Visualize metrics related to change data using dashboards in Unified Analytics.
Analyze suspected root causes more easily with AI-generated summaries.
Changes (RCC) API
Root Cause Changes can also be viewed and managed with the Changes (RCC) API.
Integrate Changes with BigPanda
Change integrations give your operations teams deeper insights into the system changes that may be triggering system events and outages. This gives Operations teams clear visibility into changes pushed by Developers, empowering the two teams to collaborate more proactively and effectively.
BigPanda includes several standard change integrations ready to connect your change feeds to BigPanda. You can also build custom integrations with the Root Cause Changes (RCC) REST API.
Learn more about integrating your change tools with BigPanda in the Integrate with BigPanda documentation.
Changes in the BigPanda Incident Console
Changes that occurred shortly before or during the incident are displayed in the incident details pane within the Changes Tab. Here operators can see vital information about changes that are possibly related to the selected incident, including status, summary, and start time.
Change Details
Operators can search the change table, dig into change details, and mark whether a change should be matched to the incident. By marking the results of change investigation in the console, teams can collaborate together to identify the real cause.
BigPanda will automatically compare change data to incoming incidents, looking for potential incident causes. If a change is highly correlated with an incident, it will appear as a Suspect in the incident details pane. A description will explain what details indicate the change may be related to the ongoing incident. While BigPanda is configured to suggest up to 5 related changes, only changes that are highly correlated will be suggested.
RCC in ServiceNow
Root Cause Changes can also be configured to appear within ServiceNow. See the AI Detection and Response for ServiceNow documentation for more information.
Show potential RCC only
Use the Show potential RCC only toggle to limit the change table to only show changes BigPanda has identified as RCC suspects.
Viewing suspects in the Incident Feed
Incidents containing a suspected root cause change are marked in the Incident Feed with a purple dot.
Hover over the purple dot to see how many suspected changes are flagged in the incident. To view more details, click on the incident and navigate to the Changes tab in the incident pane.
Merging incidents with suspected root cause changes
If you merge an incident and the source incident contains a change marked as a suspected root cause, the purple Suspect marker will be added to any matching changes in the destination incident.
Learn more about how operators can leverage changes in the BigPanda console in the Remediate Incidents documentation.
Suspected Root Cause Summary
Any environments configured with Automated Incident Analysis will automatically include an AI-generated explanation for why BigPanda marked a change as a potential root cause. This easy-to-read explanation provides more context and better insights into matches, saving you time as you hunt down the root cause of an incident.
To view this summary:
Click on an incident to access the incident details pane.
Scroll down to Potential Root Cause Changes.
Click on the change you want to investigate.
The automated explanation will be at the top of the Change Details panel.
You can also view this information by navigating to the Changes Tab within the incident details pane. From there, click on any change with the purple stars beside it, as this indicates a change that BigPanda has automatically suggested as a potential root cause change.
Automatic Root Cause Changes Suspects
Root Cause Changes (RCC) leverages an algorithm based on natural language processing and vector space models. BigPanda intuitively compares the complex and discordant data from monitoring and change tools, while considering the context and timing of causal relationships.
RCC runs calculations on key connections between incidents and changes, including:
Time Frame - how close were the change and incident
Alerts Coverage - how many of the alerts match properties in the change
Categories - groups of specific details defined for weighting and parsing matches
Each incident-change match is given a causation score based on these calculations, with a higher score indicating a more likely suspect. Changes with a high causation score are surfaced in the incident details pane as RCC Suspects.
Suspect Score
Score calculation
Change suspect causation scores do not have an upper limit. Each suspect match point gets added to the score. Higher scores indicate a stronger match and can assist in determining the most likely suspect.
Scores only appear for matches that have met the threshold in your RCC configuration. To adjust your RCC configuration, contact BigPanda Support.
To set a baseline of your scores and monitor trends, see the Suspected Changes Analysis dashboard in Unified Analytics.
Time Frame
RCC is focused on finding causation, not correlation. Only changes that have been implemented long enough to create a system event and scheduled change windows that have recently started are considered as potential causes.
Changes that happened too far before the incident are also excluded, as incidents usually happen shortly after system changes.
Alerts Coverage
Many incidents will have at least one alert that matches the data for recent changes. When only a single alert matches, the relationship between the incident and change may not be causal, especially in complex incidents with multiple downstream impacts.
To help identify strong causal relationships, RCC considers the percentage of alerts in an incident that align with the change details. Higher percentages indicate a closer connection between the incident and change.
Categories
RCC uses change details, alert tags, and incident metadata to find common values between incidents and changes.
However, not all matches imply strong connection or potential cause.
To consider the context and relationships between data, RCC breaks incident data into a hierarchy of categories weighted by importance, based on expected incident and change alignment. Different weights and parsing rules apply to tag matches in each category, making sure that matches reflect the relationship of shared system attributes and resources.
Your default RCC category configuration is built on common industry practices, system topology, and tags and processes unique to your organization.
Improving Root Cause Changes Results
RCC works best when it has rich data and meaningful relationships identified for your organization.
It's easier for BigPanda to spot causality accurately when more standardized information is available in incoming tags and description fields. If you’d like to improve your RCC results, high quality enrichment and tag normalization is an important start.
For even more refinement of results, you can request modifications to your RCC category and parsing configuration. This is a complex back-end process requiring close coordination with BigPanda support. Reach out to us at [email protected] if you are interested in adjusting your RCC configuration.
Reporting on Root Cause Changes
The Unified Analytics Root Cause Changes (RCC) dashboards help users measure and improve change management and investigation. Interactive dashboards show change details alongside alerts and incidents, allowing users to visualize these metrics over time, services, and infrastructure.
The Change Analysis Dashboard is designed to help you visualize trends and patterns in change data. It also helps you measure the maturity of change processes and the quality of change data. Use this dashboard to identify which source systems are sending changes in order to optimize your BigPanda change integrations, spot recurring issues and improve your change processes to ensure optimal outcomes with RCC.
The Suggested Changes Analysis Dashboard focuses on RCC matches and incident coverage. Use this dashboard to determine the effectiveness of your root cause changes configuration and to determine next steps for reducing MTTR.
Next Steps
Learn more about the next step in ITIL with Problem Management
Dig deeper into Correlating Changes with Incidents
Begin integrating Change Integrations
Next Steps
Learn more about the next step in ITIL with Problem Management
Dig deeper into Correlating Changes with Incidents
Begin integrating Change Integrations