Manage incidents with the L1 Agent
The BigPanda L1 Agent triages and routes incidents autonomously, without waiting for a human L1 operator. It analyzes each incident against your organization's historical incidents, runbooks, CMDB, and service desk tickets, then routes the incident to the appropriate team.
The L1 Agent is not installed by default, and must be configured before it can be leveraged. See Onboard the L1 Agent and Add the L1 Agent to ServiceNow for instructions on adding the L1 Agent to your ITSM tool.
How the agent processes an incident
The agent works through each incident in a fixed sequence:
Self-assign: the agent takes ownership of the incident so that no duplicate triage occurs.
Analyze: the agent gathers full incident context, including historical incidents, runbooks, CMDB records, and service desk tickets.
Route: the agent applies its routing decision using one of the two output modes described below.
Unassign: the agent releases the incident so the receiving team owns it.
No manual action is required to start this process.
Routing output modes
The agent routes incidents using one of two modes, configured for your organization during onboarding:
Mode | Behavior |
|---|---|
Assignment Group Tag | Sets an assignment group tag on the BigPanda incident. |
Outbound Integration Routing | Routes the incident through your existing ITSM integration. |
Presence tags
The agent adds presence tags to incidents to show which analyses contributed to its decision. These tags let you see at a glance what context was available:
L1 Agent Recommendation: the agent produced a routing recommendation.
Service Desk Correlation: the incident was correlated with service desk tickets.
Incident Correlation: the incident was correlated with other BigPanda incidents.
Historical Incidents: similar past incidents were found and used as context.
External Observability: external observability sources contributed context.
Historical incidents
When the agent finds past incidents with similar characteristics, they appear alongside the incident with the ticket fields drawn from the connected ITSM source. This gives the receiving team prior resolutions and close notes without leaving the incident.
Runbook automation
Runbook automation runs in one of two modes:
Mode | Behavior | Approval |
|---|---|---|
Context collection | The agent runs runbook steps and feeds the results into its reasoning. Read-only. | Not required |
Remediation actions | The agent takes corrective action on your systems. | Explicit approval required |
Remediation actions that change systems always require an approval workflow. Context collection does not.
For customers running the on-premises runbook worker, the worker executes runbook steps on your own infrastructure, connects to BigPanda over mutual TLS, and operates read-only by default. It uses temporary, scoped credentials at runtime rather than standing credentials.
Escalation to L2
When an incident needs human expertise, the agent delivers a structured escalation package into ServiceNow or Jira containing:
An AI-generated incident summary
Probable root cause hints
Recommended next steps
Continuous learning
The agent improves its routing over time by ingesting:
BigPanda incidents and alerts
ITSM records from ServiceNow and Jira
The IT Knowledge Graph
Knowledge bases and runbooks
Change history and topology sources
Final assignment data flows back through the Unified Data Connector, and thumbs up/down feedback on recommendations is incorporated into future decisions.
Incident correlation in ServiceNow
For correlated incidents, the agent creates a parent Case ticket and links the related incidents to it as children. Closing the parent Case closes all child tickets.