What Event Management operators do
As an Event Management operator, your typical workflow involves three phases: analyzing an alert and its effect on application services, taking some type of action, and making sure the alert is finally closed.
This is the last lesson in the Event Management tutorial. In this lesson, you will run through the three phases of a typical operator day-to-day workflow.
| Lesson 1 | Image omitted: progress-complete2.png Overview icon | An overview of events and alerts |
| Lesson 2 | Image omitted: progress-complete2.png Overview of BS icon | An overview of application services |
| Lesson 3 | Image omitted: progress-complete2.png Operators icon | Event Management Service Operations Workspace |
| Lesson 4 | Image omitted: progress-wip.png Operators do icon | What operators do |
Your organization will have specific policies and procedures that may differ from the phases outlined in this topic. In addition, your administrator might have customized the Event Management application so that some of these phases are automated and do not actually require any action on your part.
For the purposes of this tutorial, we will walk you through each phase and allow you to perform the tasks manually.
| Phase 1 | Analyze and acknowledge an alert | In this phase, you will find an alert to work on, analyze the details, and acknowledge it so that other operators know it is a legitimate alert. |
| Phase 2 | Triage an alert | In this phase, you take an action to help remediate the issue that caused the alert. The most common action to take is to create an incident and assign it to someone who can solve the underlying issue. |
| Phase 3 | Close an alert | In this phase, you will verify that the alert is resolved, and then close the alert. |
Start here
Start out by learning how to Analyze and acknowledge an alert.
- Operator phase 1: Analyze and acknowledge an alert
As an Event Management operator, the first thing you should do is access alerts and then find the ones you want to focus on. You can open the Alert form to analyze the details, and then acknowledge it to let other operators know that the issue causing the alert should be addressed in some way. - Operator phase 2: Triage an alert
After you analyze and acknowledge an alert, you must triage it. The triage phase involves verifying alert correlation and taking an action to help resolve the issue that caused the alert. This topic covers the most common triage task: creating an incident from an alert. - Operator phase 3: Close an alert
After you take action on an alert, you can verify several items on the alert and then close it.
Parent Topic:Event Management Operator Tutorial