Need help with level of effort/cost/time to deliver event management within my enterprise

[pierredavis]

Currently looking to stand up Event Management in SN and trying to scope the work. Tying to figure out how to scope things. High level of what we are planing to to

- Configure/set up the event management module

- Integrate with monitoring systems to ensure tight integration with Incident, Problem etc

- Implement best practices

Also would like to know what an ideal time line could be to stand this up and resources needed

[syedfarhan]

Hi Pierre,

It depends on resource bandwidth . I can Give you an outline of 5 to 7 days which includes 8 hrs per day. I'm not sure about cost.

2 to 3 resource is more than enough.

Thanks

[pierredavis]

So would you say (1) implementation specialist and (1) project manager to run the project. Any thoughts on the scope of work.

The high level details of how one would approach it

[syedfarhan]

Yes. One developer and one project manager is enough.

Need to study the case studies before implementing anything in ITSM. Do a little bit ground work and go for it

Thanks

[Tony Branton]

Hi Pierre,

I recommend the following resources:

• Project Manager - advantage if they have prior experience with infrastructure or systems management projects
• Solution Architect - with a background in enterprise monitoring
• Technical Consultant - experience with the Event Management and ITSM applications, ServiceNow scripting and workflow, and experience regex, scripting (Python, Perl, etc) and integrating monitoring tools

The approach I recommend for the implementation is something like:

• Planning workshops to:
  • Identify and review in-scope event sources
  • Determine integration methods
  • Identify MID Server placement (if needed for connectors or SNMP traps)
  • Review event data formats to identify field mapping requirements
  • Review event types and volumes to identify processing requirements (filter, transform, etc)
  • Review CI binding requirements (also review any business service maps that may be used for service impact management)
  • Review alert processing requirements (e.g. to create and populate an incident, link knowledge, run remediations, etc)
  • UI and reporting requirements
• Solution Design
  • Document the design including integration architecture, event and alert processing requirements, security (users, roles, etc), UI config and custom reports, etc
• Test Plan - either you lead or the customer does it
• Implementation
  • Deploy MID Server(s)
  • Integrate event sources (I recommend one at a time)
  • Create users and assign roles
  • Create and test Event Rules, Field Mapping Rules, CI binding, convert manual service maps, etc
  • Create and test Alert Rules, Task Templates, custom incident population (if needed), remediation workflows
  • Configure UI and create custom reports as required
  • Create as-built document
  • Conduct testing
• Production Deployment - if the above was done in non-Prod, then migrate configurations to Production, conduct testing, As-Built documentation
• Go-Live support

The effort and time estimate are very dependent on the number of event sources, how event sources are integrated (Event Connectors and REST require less event rules), whether service impact management is in scope, ITSM integration and how complex remediation tasks might be (I recommend shifting that to a phase II project).   You may also need to consider whether effort is split between a vendor and customer resources, and how experienced/trained the resources are (no training/experience increases effort, time and risk).

Hope this helps.