Extending autonomous L1 ops with new suppression and runbook capabilities
Earlier this year, I had the chance to meet with one of our airline customers. During the meeting, we discussed how to use agentic technology to automate L1 workflows. As one of the largest global airlines, they have many applications and service teams focused on flight-critical, tier 1 environments. Any downtime can cause costly delays and unhappy customers.
One of the leaders of the L1 teams shared how he was woken up late one night by an alert that crossed a threshold and resulted in a system throttling. In the early morning, he logged in to triage, looking across tools and incomplete runbooks, only to realize the incident was just noise. All he had to do was suppress it.
This was harmless in nature, but across multiple shifts and operators, the cost of this excess noise is substantial. L1 teams having to snooze incidents distracts them from actual incidents with real negative effects on services, customers, and revenue. Luckily for this director of L1 teams, he had the institutional knowledge of what to do, but across multiple teams, data silos and a lack of context cause teams to stall and interrupt workflows.
The next step toward the agentic IT operations vision
When we launched the BigPanda L1 Agent, we talked about a whole new operating model, one that runs on autonomous, AI-native operators that triage and act on incidents. These agents enable enterprises to scale without adding headcount. The first step in that vision was ticket assignment, in which the L1 Agent autonomously identifies the appropriate team and assigns the ticket without human intervention.
Today, the BigPanda L1 Agent, now included in the AI Detection and Response (ADR) product, is taking another step toward that agentic vision by adding automated suppression and the ability to execute runbook steps.
Automated suppression from BigPanda ensures noise never reaches your team
Using automated suppression, the agent identifies false positives, self-resolving incidents, and known noise and then suppresses them before an operator ever sees them. This avoids the 3 am page and the additional investigation just to confirm it’s nothing at all.
Event management tools have suppressed noise for years, but automated suppression is fundamentally different. Traditional alert suppression relies on prewritten, static rules that someone must develop and continually tune as the environment changes. Automated suppression, on the other hand, is based on the same deep triage the agent performs for every incident, using the BigPanda IT Knowledge Graph to gather and analyze context from runbooks, historical incidents, the service desk, other incidents, and external factors. By utilizing this context, suppression happens at scale and with greater accuracy than is feasible with a human L1 operator.
BigPanda takes runbook execution from documented steps to autonomous action
Suppression handles the incidents that don’t need human intervention, essentially low-risk noise. Runbook execution addresses incidents that impact applications and services and require some form of action, such as restarting a hung process, running health checks on an unresponsive device, or triggering an automation workflow to remediate a known failure.
Every execution starts with runbook matching. During triage, the agent uses the IT Knowledge Graph to find the runbook that applies to the incident, read it, and surface the documented steps in its recommendation. That match is what makes autonomous action trustworthy. The agent doesn’t improvise a fix; it carries out the procedure your organization already relies on.
When an incident requires a response, the agent matches it to your organization’s runbooks, identifies the documented steps, and automatically executes them. Because ADR learns from what actually happens in your environment through the IT Knowledge Graph, not only what is written down, those runbooks don’t need to be perfect. The agent observes how your team resolves incidents and improves on that knowledge over time. Institutional judgment, often stuck in someone’s head, is applied consistently to every incident. If an incident exceeds what is covered in a runbook, the agent can escalate it with full context so L2+ engineers don’t have to start from scratch.
AI tools that allow your enterprise to define the boundaries
These new features help automate L1 workflows, but that doesn’t mean you’re giving up control. Your team still defines the boundaries and parameters upfront, such as what qualifies for suppression, which runbooks run autonomously, and where the agent pauses for human confirmation. This allows you to build trust with how the agent acts and expand at your own pace.
This is what changes the economics of L1 operations. Early design partners like Gamma are already running this model in their organization. Utilizing agentic IT operations, the telecommunications organization has reduced MTTR and expanded human capacity by automating L1 tasks.
Automated suppression and runbook execution from BigPanda are available today
Automated suppression and runbook execution are available now as part of BigPanda AI Detection and Response. Existing customers can contact their account team to enable these capabilities. If you’re new to BigPanda, please book a demo to see autonomous L1 operations in action.
