What Event Management operators do

As an Event Management operator, your typical workflow involves three phases: analyzing an alert and its effect on application services, taking some type of action, and making sure the alert is finally closed.

This is the last lesson in the Event Management tutorial. In this lesson, you will run through the three phases of a typical operator day-to-day workflow.

Lesson 1		An overview of events and alerts
Lesson 2		An overview of application services
Lesson 3		Event Management Service Operations Workspace
Lesson 4		What operators do

Your organization will have specific policies and procedures that may differ from the phases outlined in this topic. In addition, your administrator might have customized the Event Management application so that some of these phases are automated and do not actually require any action on your part.

For the purposes of this tutorial, we will walk you through each phase and allow you to perform the tasks manually.

Phase 1	Analyze and acknowledge an alert	In this phase, you will find an alert to work on, analyze the details, and acknowledge it so that other operators know it is a legitimate alert.
Phase 2	Triage an alert	In this phase, you take an action to help remediate the issue that caused the alert. The most common action to take is to create an incident and assign it to someone who can solve the underlying issue.
Phase 3	Close an alert	In this phase, you will verify that the alert is resolved, and then close the alert.

Start here

Start out by learning how to Analyze and acknowledge an alert.

• Operator phase 1: Analyze and acknowledge an alert
  As an Event Management operator, the first thing you should do is access alerts and then find the ones you want to focus on. You can open the Alert form to analyze the details, and then acknowledge it to let other operators know that the issue causing the alert should be addressed in some way.
• Operator phase 2: Triage an alert
  After you analyze and acknowledge an alert, you must triage it. The triage phase involves verifying alert correlation and taking an action to help resolve the issue that caused the alert. This topic covers the most common triage task: creating an incident from an alert.
• Operator phase 3: Close an alert
  After you take action on an alert, you can verify several items on the alert and then close it.