What is the event management process?
Event management follows a very specific path, from event creation to incident resolution.
First, an event is created, likely with routine notifications regarding normal device changes in the enterprise. However, some will inevitably exceed the specifications and ranges defined in a correlation search by the event analyst. These are notable events, and they will be recorded as such in the event management system.
As notable events are filtered and aggregated, they are collected into an episode, which defines a cluster of notable events in an event category. It is the event analyst’s job to act upon these episodes, first by determining event value and performing triage to determine how best to remedy the episode, which either resolves it directly or assigns it to another analyst. The status of the episode is updated to “in progress” or “pending” while it is being investigated and acted upon. Once a fix is in place, the episode is marked as resolved.
A final analyst reviews all of the above and, once satisfied with the results, closes the episode.