1. Notifying the Enterprise about Outages
James Voorhees
April 2009
SANS Technology Institute Presentation

2. SANS Technology Institute Presentation
Tasks
When users at <COMPANY NAME> cannot use a service, someone must
Tell the people who can fix it
Tell the people who need to know
The number of events that you see in ArcSight will far exceed the number that you or your team can analyze. They need to be pared down and then displayed in the tools that ArcSight provides you in a way that makes it easy to determine quickly what is going on in the network and to find the events of interest that are worthy of further investigation and may require action.
There is no quick way of doing this. It takes time and effort that may be hard to spare from other tasks. But a failure to put in that time and effort will mean that ArcSight will not reach its potential.
This task needs to be approached methodically, with a clear plan in mind. This presentation will give you a clear path to follow.s
Script:
To star; Ask: how many use a SIM?
How many get enough out of it to justify the cost?
Mention GIAC-Alumni query
SANS Technology Institute Presentation

3. SANS Technology Institute Presentation
The NOSC
Network Operations and Security Center
Monitors the network 24/7/365
If something goes down, they know
Maintains notification lists
Documents each outage
SANS Technology Institute Presentation

4. SANS Technology Institute Presentation
Outage!
NOSC sees it in its monitoring tools
Or the NOSC is told by system owners
They must tell the NOSC before a planned outage happens
Or as soon as they learn of an unplanned outage
SANS Technology Institute Presentation

5. SANS Technology Institute Presentation
Action: Find the Fixer
The NOSC maintains a list of contacts for each system
If a system or service goes down, the NOSC informs the contact
The contact can then fix the system
Or find the person who can
SANS Technology Institute Presentation

6. SANS Technology Institute Presentation
Then, Inform
The Outage List is informed
This is a list of people and groups who are affected by most outages or can end them.
It includes systems and network people and the Help Desk
The NOSC tells them
What the outage is
When it happened
Why it happened
Also, what is being done and how long it will take
SANS Technology Institute Presentation

7. SANS Technology Institute Presentation
Senior Management
If a major outage lasts 12 hours, Senior Management wants to know.
Like the Outage List, the NOSC tells them what happened, when, and why
And who is doing what
SANS Technology Institute Presentation

8. SANS Technology Institute Presentation
Updates
When the situation changes, the Outage List is informed
Senior Management is updated every 12 hours.
This is done until the outage ends
SANS Technology Institute Presentation

9. SANS Technology Institute Presentation
Questions?
Contact the NOSC:
SANS Technology Institute Presentation