Historical Incidents
Unified Data Connector
Your organization must be using the Unified Data Connector to use Historical Incidents. Contact your BigPanda account team for more information.
Past incidents are a valuable source of information during the incident management process. Reviewing incidents with similar characteristics can help you understand recurring issues and accelerate the resolution process. However, this process can be very manual and time-consuming, requiring you to search through large groups of incidents to identify similarities.
Historical Incidents speeds up this process by identifying incidents with matching characteristics within the Incident Details pane. Each historical incident includes details such as impact, assignment, steps to resolve, and a summary describing why the incident was considered similar.
Historical incidents are chosen based on a similarity score. The score is calculated using similarity categories based on entity, problem, impact, and topology. A list of the incidents most similar to the selected incident is generated each time you access the Historical tab within the Incident Details Pane.
Use similar incidents to improve MTTR and help your team learn from past resolution steps.
BigPanda University Advanced Insight Module course
Learn more in the BigPanda University Advanced Insight Module course.
By the end of the course you will be able to:
Generate and review AI Analysis reports for your incidents that will help you reduce MTTR.
Review root cause change suspects and identify changes that are the root cause of incidents.
Compare incidents with similar characteristics to enhance context and resolve incidents faster.
Click here to enroll.
Key Features
Reference existing incidents from within the Incident Details pane.
See at a glance how similar matched incidents are, and what elements matched.
View the key outcomes and the root cause of historical incidents at a glance.
Relevant Permissions
Roles with the following permissions can view Similar Incidents:
Role Name | Description |
|---|---|
Environment - Incident Actions | Full access ability to perform actions on all enrichment tags and incidents in the specified environment. |
Environment - View | Read-only access to all enrichment tags and incidents in the specified environment(s) without the ability to change or perform any incident action. |
See the Roles Management page to learn more about Environment permissions in BigPanda.
Similarity Calculation
The Similarity match percentage is calculated based on a group of categories defined in the table below. For an incident to be considered a similar historical incident, it must have a score of at least 55 percent.
The Entity and Problem categories are required for an incident to be considered by the algorithm, and are weighted higher even when Impact and Topology are included.
Default tags
Your organization may have a different set of default tags configured for these categories. The Example Default Tags listed in the table below are common tags many organizations include in use to define each category. You can choose to include or exclude tags as needed.
To adjust your category tags, contact BigPanda support.
Updating tags
When you add new tags or integrations, your default category tags will need to be updated to ensure your similarity scores remain accurate.
To have your tags reindexed, contact BigPanda Support.
Category | Definition | Example Default Tags |
|---|---|---|
Entity | The primary affected entity for each alert such as the host, node, device, or database. For certain alerts, the entity may be the application, container, endpoint, etc. This identifies the specific element experiencing the issue. | host node object |
Problem | The specific issue observed for each alert, such as the check, alert title, or condition name. This details the nature of the detected failure. | check problem title |
Impact | Any associated or dependent systems, applications, services, platforms, or clients/customers that may be affected by any of the alerts. This details the potential effects and reach of the problem. | app application service |
Topology | Additional attributes about each of the affected entities that provide relational context, such as environment, datacenter, location, cloud provider, or cluster. This outlines the entity's physical or logical location within the IT environment. | dependency connected_to host_basename |
View Historical Incidents
To view historical Incidents, navigate to the Incident Details pane and open the Historical tab.
Number of similar incidents
The number of similar incidents found within the past 30 days appears within both the Overview tab and on the Similar tab itself. This allows you to see if recent similar incidents are available prior to clicking the tab.
The Historical tab displays the most relevant historical incidents from the selected time period.
Historical incidents are ordered according to their similarity score, with the most similar incidents appearing first. See the Similarity Calculation section for more information about how the score is calculated.
If two incidents have the same similarity score, the most recent incident will appear in the list first. If no similar incidents exist, a “No results found” message will appear.
By default, only incidents from the last 30 days will appear in the list. Use the dropdown at the top right of the tab to select a predefined time period or choose a custom time period. You can select incidents from up to 15 months ago.
Time Period
Historical incidents searches any incidents that were active or updated 24 hours to 15 months before the tab is selected.
Historical Incidents in ServiceNow
Historical Incidents can also be configured to appear within ServiceNow. See the AI Detection and Response for ServiceNow documentation for more information.
Historical Incident Details
Within the Historical tab, each matched incident displays basic incident details, including the incident title, assignee, number of alerts, priority, comments, shares, resolver, and assignment group.
You can click the comment or share button to view the comments and shares. Click Open Incident to open the historical incident in a new tab.
The bottom portion of the ribbon displays information about why the incident was considered similar, including the similarity score, matched similarity categories, and a short summary.
Matched categories
Only categories that match with at least a 75 percent score appear on the ribbon.
Categories with scores lower than 75 percent appear in the details screen.
Incident Details
To view additional details about why an incident was considered similar, click the bottom part of the ribbon. This expands the matched incident details, where you can view additional information, including how closely the incident matches in each category, and an incident summary for each category.
You can send feedback on the accuracy or helpfulness of the selected historical incident.
If the incident is similar, click Yes to let us know that the selection was helpful for your triage efforts.
If the incident was not similar or helpful, click No. You’ll then be prompted to provide feedback to let us know what was wrong.
To see more details for a historical incident, click Open Incident. This will open the incident in the Incident Details pane.
Historical Incidents in ServiceNow
If your organization uses version 2.9.2 or higher of the ServiceNow integration, you can view historical incidents from within the incident details screen in ServiceNow.
Historical Incidents are viewed in a new tab in Incident Details. For each incident that was identified as similar, the tab shows:
Link to the incident
Similarity score
Incident details such as state, impact, priority, and assignment group
Resolution code
Close notes
Reviewing these incidents can help you understand recurring issues and accelerate the resolution process.
See the AI Detection and Response for ServiceNow documentation for more information.