Alert to incident

Step by step

1. Review alert Log Operator

   The Log Operator checks the query, time window, match count and linked stream before involving the response team.

   • Query evidence is tied to a service source.
   • Updates Log alerts, Log streams

2. Open incident Incident Responder

   The Incident Responder records a summary, priority, service, asset and assignee with the opening time.

   • Service response receives priority and an assignee.
   • Updates Incidents, Services, Assets, People

3. Acknowledge incident Incident Responder

   On a new incident or authorized inbound event, the response workflow stamps the actual acknowledgment time and moves the incident to acknowledged. The assigned responder checks the work.

   • Actual acceptance time and status are recorded.
   • Updates Incidents

4. Investigate incident Incident Responder

   The responder enters investigating status and adds authored updates as observations or actions occur.

   • Authored observations stay with the incident.
   • Updates Incidents, Incident updates

5. Review cause Service Owner

   The Service Owner uses a problem record when the service needs a continuing root-cause investigation.

   • Longer root-cause work gets an owner.
   • Updates Problems, Services

6. Resolve incident Incident Responder

   The responder records the resolution time, moves to resolved and later closes the completed response.

   • Resolution time and final status are recorded.
   • Updates Incidents

Log Operator

, Incident Responder, Service Owner