Setting First Response when Resolving incidents

Josh_Schmiedel

Hi everyone, 

I did some searching around and didn't see this question asked before, so I wanted to bring it to everyone to see if someone has cracked this problem already...

A common issue we have in our environment is that many times when resolving an incident, some of our analysts don't check to make sure the "acknowledge" task has been completed, and thus causes the "response" SLO to breach as it's never completed. 

My question is this: does anyone know a way to script checking to see whether or not the acknowledge task is completed, and if not, either prompt the analyst to acknowledge the incident, or automatically acknowledge it at the time of response? I know the latter is rewarding bad behavior, but something is better than nothing, right??

Josh_Schmiedel

Nick_Flint said:

We've talked about this a bit in my organization too. I haven't done it yet, but my thought was to create an orchestrator runbook that monitors IRs for Status change to Resolved and SRs for Status change to Completed. Then run a powershell script that uses the resolution/completion date to set the first response date. It shouldn't be too hard but I have no idea when I'll get to it.

Thanks, Nick. That's what I've seen and heard too, was to use SCOrch. I don't have the experience or access to SCOrch in our environment to be able to play around with it, but would love to see your results if you decide to tackle it!

Nick_Flint

We've talked about this a bit in my organization too. I haven't done it yet, but my thought was to create an orchestrator runbook that monitors IRs for Status change to Resolved and SRs for Status change to Completed. Then run a powershell script that uses the resolution/completion date to set the first response date. It shouldn't be too hard but I have no idea when I'll get to it.

Josh_Schmiedel

Nick_Flint said:

We've talked about this a bit in my organization too. I haven't done it yet, but my thought was to create an orchestrator runbook that monitors IRs for Status change to Resolved and SRs for Status change to Completed. Then run a powershell script that uses the resolution/completion date to set the first response date. It shouldn't be too hard but I have no idea when I'll get to it.

Thanks, Nick. That's what I've seen and heard too, was to use SCOrch. I don't have the experience or access to SCOrch in our environment to be able to play around with it, but would love to see your results if you decide to tackle it!