Stream to alert

Step by step

1. Register stream Log Operator

   The Log Operator records the source endpoint, retention days and service. Registration creates a processing receipt for the responsible reviewer.

   • Source and retention setting are saved; a processing receipt is created for review.
   • Updates Log streams, Services, Integration receipts

2. Capture alert Log Operator

   The operator records the query definition, observed window and match count against that stream. The alert begins open.

   • Query, window and match count are recorded with an open alert.
   • Updates Log alerts, Log streams

3. Acknowledge alert Log Operator

   An operator takes responsibility for triage and moves the alert from open to acknowledged.

   • Alert status becomes acknowledged.
   • Updates Log alerts

4. Review service context Service Owner

   The Service Owner checks the linked service, its criticality and its owner before asking for incident work.

   • Owner and criticality inform the response.
   • Updates Services, Log streams, Log alerts

5. Close alert Log Operator

   When the signal has been triaged, the operator closes the alert. Any incident continues on its own response path.

   • Triage status becomes closed.
   • Updates Log alerts

Log Operator

, Service Owner, Incident Responder