What are AI suggested actions?
AI suggested actions are context-aware recommendations, generated automatically by AI, that tell L1 NOC operators exactly what to do next during an active incident. Surfaced automatically by AI Detection and Response, they draw on historical ITSM incidents and similar past resolutions to deliver specific remediation steps the moment an incident opens, before any manual investigation is needed. Also referred to as AI suggested actions, AI next steps, AI-powered incident recommendations, and NOC incident triage AI.
Suggested actions apply AIOps to the point in the workflow where L1 operators lose the most time. They make the difference between an L1 operator who opens a ticket and immediately knows what to do, and one who spends the opening minutes of the incident figuring out who to call. The mechanism stays the same across naming variations. AI reads incident context, queries historical resolution data, and returns specific next steps before a human has to ask.
Why suggested actions matter for NOC teams
When an alert fires, the opening minutes are usually spent figuring out what the incident is and who should own it, not resolving it. A 2023 Enterprise Management Associates (EMA) survey found that 43% of respondents named prioritization and routing as the phase of incident management that most needs improvement.
The problem compounds when institutional knowledge sits with a few senior engineers. When one of them is unavailable, runbooks are outdated and the team starts from scratch. Suggested actions address this by capturing resolution knowledge every time an incident closes and making it available to every operator going forward, regardless of who is on shift. For a fuller picture of how alert noise and correlation fit into this workflow, see AI Detection and Response.
How AIOps suggested actions work
- Step 1: AI Detection and Response ingests and correlates signals across observability tools, service desk activity, and recent changes into a single unified incident. For detail on how correlation and noise reduction work, see AI Detection and Response.
- Step 2: AI queries the IT Knowledge Graph, which unifies observability, ITSM, and organizational data, to find similar historical ITSM incidents and the resolution patterns that match the current incident’s profile.
- Step 3: AI generates incident remediation next steps and surfaces them alongside the unified incident summary. Every recommended action includes the reasoning behind it.
- Step 4: The L1 operator reviews the suggestions, applies judgment where the situation calls for it, and acts or delegates. The outcome feeds back into the IT Knowledge Graph, improving future recommendations.
Traditional L1 triage vs. AI-powered suggested actions
The contrast between approaches is most visible in the first few minutes of an incident, when manual triage is slowest and the cost of downtime is already running.
| Traditional L1 triage | AI-powered suggested actions |
|---|---|
| Manually search historical tickets for similar incidents | Historical ITSM incidents surfaced automatically at incident open |
| Consult colleagues to find who knows this service | Recommended remediation steps already attached, based on similar past incidents |
| Rely on whoever is on shift for guidance quality | Consistent guidance regardless of shift, time zone, or team composition |
| Escalate upward when unsure, even for solvable issues | Escalate only when genuinely needed, with full context already packaged |
| Lose resolution knowledge when each incident closes | Resolution patterns captured and reused by the IT Knowledge Graph |
What makes suggested actions different from black-box AI
AI Detection and Response is open-box by design. Each suggestion arrives with the evidence behind it: the historical incident it matched, the team that owned that incident, and how it was resolved. Operators who understand why a suggestion exists are more likely to trust it and act on it. They can confirm the reasoning fits their environment and flag suggestions that miss the mark.
This is also where suggested actions differ from autonomous execution. Suggested actions are recommendations. The operator reviews them, applies judgment, and decides whether to act, delegate, or override. L1 Agent and auto-remediation remove that step for incident types that don’t require it. Both models draw on the same IT Knowledge Graph, but the human-in-the-loop stays intact with suggested actions by design.
Black-box models produce outputs without explanation. When an L1 operator can’t see why a recommendation was made, the safe move is to ignore it or escalate anyway. Open-box AI keeps the operator in control and makes the reasoning auditable, which matters for team confidence and post-incident review.
Where suggested actions fit in the platform
Suggested actions are part of AI Detection and Response, one of four products on the Agentic ITOps platform. The full platform story, including how all four products connect across the incident lifecycle, lives on the platform overview page.
- AI Incident Prevention: stops change-related incidents before they happen.
- AI Detection and Response: correlates signals and surfaces suggested actions for L1 operators to review and act on.
- L1 Agent: resolves high-volume, repetitive L1 work autonomously, without waiting for an operator to initiate each step. See L1 Agent for how autonomous execution differs from the recommendation model here.
- AI Incident Assistant: supports L2, L3, SRE, and major incident teams through investigation, collaboration, and post-incident reporting. It operates later in the incident lifecycle than suggested actions.
The IT Knowledge Graph is what connects these products. It converts resolution history into reusable intelligence, so similar incidents can surface what happened in comparable past events and what resolved them, giving every operator the same starting point a senior engineer would have.
The IT Knowledge Graph builds continuously from closed incidents, applied remediation steps, and operator feedback, so suggested actions become more specific to your infrastructure over time rather than drawing on generic best practices.
Results from teams using AI Detection and Response
These outcomes come from across the platform, not from suggested actions alone. The Business Value of the BigPanda Platform report, covering 23 enterprise customers from November 2024 to July 2025, found an average ROI of 430% with payback in under a year.
| Customer | Result |
|---|---|
| Bungie | 99% alert compression |
| Cambia Health Solutions | 83% of alerts automated; critical alerts identified in 30 seconds at L0/L1 |
| FreeWheel | 20 hours saved per incident with auto-remediation |
| Autodesk | 69% reduction in incidents |
Frequently asked questions about suggested actions (AI)
Do suggested actions require clean CMDB data or pre-built rules?
No. The IT Knowledge Graph improves as a byproduct of daily operations. The AI derives patterns from historical incident and resolution data rather than relying on manually authored logic or clean CMDB input.
How do suggested actions surface similar past incidents?
The AI matches current incidents to historical events using signal patterns, topology data, and resolution history. When a match is found, the resolution path is surfaced as part of the suggested actions automatically at incident open, so the operator sees historical context without having to search for it.
Can L1 operators give feedback on suggested actions?
Yes. Operators can flag suggestions that don’t fit, override them, and apply their own judgment. That feedback becomes part of the IT Knowledge Graph and improves future recommendations for your specific environment.
How do suggested actions connect to root cause analysis?
Suggested actions work alongside root cause analysis. When the AI identifies a probable root cause, the suggested steps reflect that cause so operators know what happened and what to do about it. As root cause identification improves with more incident history, the suggested actions tied to those causes become more precise. For incidents that escalate beyond L1, AI Incident Assistant picks up the investigation thread for L2, L3, and SRE teams.
What is the difference between suggested actions and automated remediation?
Suggested actions are recommendations that keep a human in the loop. The operator sees the suggested path, confirms it fits the situation, and acts. Auto-remediation and L1 Agent apply the same intelligence without waiting for that confirmation step, which suits high-frequency, well-understood incident types where human review adds latency without adding value. Most teams run both in parallel: suggested actions for incidents that warrant human judgment, and autonomous execution for repetitive work that doesn’t.
PLATFORM
BigPanda Agentic ITOps
See how BigPanda uses agentic AI in IT operations.
