Manage incidents with the L1 Agent
The BigPanda L1 Agent triages and routes incidents autonomously, without waiting for a human L1 operator. It analyzes each incident against your organization's historical incidents, runbooks, CMDB, and service desk tickets, then routes the incident to the appropriate team.
The L1 Agent is not installed by default, and must be configured before it can be leveraged. See Onboard the L1 Agent and Add the L1 Agent to ServiceNow for instructions on adding the L1 Agent to your ITSM tool.
How the agent processes an incident
The agent works through each incident in a fixed sequence:
Self-assign: the agent takes ownership of the incident so that no duplicate triage occurs.
Analyze: the agent gathers full incident context, including historical incidents, runbooks, CMDB records, and service desk tickets.
Route: the agent applies its routing decision using one of the two output modes described below.
Unassign: the agent releases the incident so the receiving team owns it.
No manual action is required to start this process.
Routing output modes
The agent routes incidents using one of two modes, configured for your organization during onboarding:
Mode | Behavior |
|---|---|
Assignment Group Tag | Sets an assignment group tag on the BigPanda incident. |
Outbound Integration Routing | Routes the incident through your existing ITSM integration. |
Presence tags
The agent adds presence tags to incidents to show which analyses contributed to its decision. These tags let you see at a glance what context was available:
L1 Agent Recommendation: the agent produced a routing recommendation.
Service Desk Correlation: the incident was correlated with service desk tickets.
Incident Correlation: the incident was correlated with other BigPanda incidents.
Historical Incidents: similar past incidents were found and used as context.
External Observability: external observability sources contributed context.
Historical incidents
When the agent finds past incidents with similar characteristics, they appear alongside the incident with the ticket fields drawn from the connected ITSM source. This gives the receiving team prior resolutions and close notes without leaving the incident.
Runbook automation
The L1 Agent uses your runbooks to decide what to do, and your own infrastructure to do it. BigPanda does not connect to your systems directly or run commands on them.
For each incident, the agent determines which runbook applies and composes a specific, scoped set of steps for that incident. Those steps are passed to the on-premises worker running in your environment, which executes them and returns the results. The agent reads the results and decides what to do next.
Mode | What happens | Approval |
|---|---|---|
Context collection | The worker runs diagnostic steps and returns the results. The agent uses them in its reasoning. Read-only — nothing on your systems is changed. | Not required |
Remediation actions | The worker takes corrective action on your systems, such as restarting a service or clearing a queue. | Explicit approval required |
Your infrastructure, your runbooks, your credentials
Your infrastructure, your runbooks, your credentials
The on-premises worker runs inside your environment and only executes steps your runbooks define. It connects outbound to BigPanda over mutual TLS, holds no standing credentials, and assumes a service role you define for the duration of each execution. BigPanda never authors or modifies your runbooks.
Working with your automation platform
The L1 Agent works with the automation you already have rather than replacing it. Any system that exposes an HTTP interface can be part of a runbook.
There are three common patterns, and most organizations use more than one:
Pattern | How it works |
|---|---|
Collect data from observability tools | A runbook step queries a monitoring or observability tool to gather live data. The agent uses the result to decide what to do next. Read-only. |
Trigger your automation platform | A runbook step triggers a job in your existing automation platform, waits for the result, and continues based on what comes back. The automation platform performs the action; the agent decides when to run it and what to do with the outcome. |
Scope sensitive steps to a controlled tool | Where an action is sensitive, each runbook step triggers a separate, narrowly defined job in a tool you control, rather than granting broad execution rights. |
The L1 Agent complements your automation platform
If you already use an automation platform, you continue to use it. The agent adds the decision layer around it: working out which automation to run for this incident, reasoning over the results, and recommending or executing the next step. It does not replace the platform that performs the action.
Escalation to L2
When an incident needs human expertise, the agent delivers a structured escalation package into ServiceNow or Jira containing:
An AI-generated incident summary
Probable root cause hints
Recommended next steps
Continuous learning
The agent improves its routing over time by ingesting:
BigPanda incidents and alerts
ITSM records from ServiceNow and Jira
The IT Knowledge Graph
Knowledge bases and runbooks
Change history and topology sources
Final assignment data flows back through the Unified Data Connector, and thumbs up/down feedback on recommendations is incorporated into future decisions.
Incident correlation in ServiceNow
For correlated incidents, the agent creates a parent Case ticket and links the related incidents to it as children. Closing the parent Case closes all child tickets.