Case Management from Sentinel

Case Management, in Explorer, is all about actions and changing the status of events raised in source applications such as Sentinel, along with related case commentary. You can also manually raise a case in Explorer.

Sentinel has configuration options for raising cases for certain events, under specific conditions.

In Explorer, cases can be automatically prioritised daily, according to a set of configurable rules.

Cases can also be pushed through various statuses (New, Investigating, Rejected/Confirmed, Closed, Deprecated), with each case assigned to a single user at a time. Cases can be re-assigned at any stage, and comments can be added to cases. 

Case Management Configurations

Case Management in Sentinel can be configured at various levels, and can also be overridden in places.

Case Management is optional in Sentinel, and is enabled in the Sentinel configuration file

This affects what is shown in the User Interface.

Aggregate Cases

The second level of configuration is at a Category level.

This option is configured and updated separately (refer to the Sentinel Installation and Administration Guide, in the section: Case Management), and cannot be changed from within the Sentinel application.

If Aggregate Cases is enabled for a category, and there are open cases for the category, then no new cases are raised by Sentinel for that category; instead, a comment is added to the most recent open case of that category. The comment includes the following details:

Event Raised:

[Comment from the originating test’s case options]

When there are no open cases for the category, a single case for that category can be raised.

Note: Every monitor belongs to a category. A new case is raised in a Case Form of the same category as the monitor.

Case Options

Case options have default values that are defined in the Sentinel Configuration file. These values can be overridden in Sentinel, per Test. 

Case Options can be updated in a Test, and will affect all cases that are raised when the test runs.

Graphical user interface, text, application, email

Description automatically generated

Case Title

This is the default title that Sentinel generates when a case is raised with an event, and appears in the case details in Explorer. This is defined in the Sentinel configuration file, but can be updated for a Test.

Setting in the Sentinel Configuration file: DefaultCaseTitle

Case Description

This is the default description that Sentinel generates when a case is raised with an event, and appears in the case details in Explorer. This is defined in the Sentinel configuration file, but can be updated for a Test.

Setting in the Sentinel Configuration file: DefaultCaseDescription

Case Comment

This is the default comment that Sentinel generates when a case is raised with an event, and appears in the case details in Explorer. This is defined in the Sentinel configuration file, but can be updated for a Test.

Setting in the Sentinel Configuration file: DefaultCaseComment

Case Comment Override

When you set up the state configuration for a test, you can override the test’s Case Comment, for a specific state.

Graphical user interface, application

Description automatically generated

Only Create New Cases if Event State was Previously Severity of None

If this option is selected, a case is only raised if the event state has had a severity of None since the last case was raised.

Setting in the Sentinel Configuration file: OnlyCreateCasesDefaultOption. This is selected by default if specified as True in the Sentinel Configuration file.

Automatically Close Cases When Deferred Actions are Complete

If this option is selected, Sentinel automatically closes a case after it is confirmed (a user sets a case to confirmed in Explorer). If there are deferred actions set for the event, Sentinel closes the case after it carries out the actions.

Setting in the Sentinel Configuration file: AutoCloseCasesAfterConfirmation. This is selected by default if specified as True in the Sentinel Configuration file.

Manage Case for a State

At this level, you can configure Sentinel to raise a case with the event. If you select this option, then Deferred Actions is also an option. Sentinel will defer all actions for the state until the case is confirmed. If the case is rejected, the actions will not happen at all.

Graphical user interface, application

Description automatically generated

Case Priorities

Priority rules can be set at a Category level, by a System Administrator. If a case belongs to a category that has prioritisation rules defined, its priority may be updated by the system during the daily Server service run. Every case is evaluated against a defined set of conditions particular to a category, and given a priority based on this evaluation.

Each new case is immediately prioritised according to the rules. If there are no rules that apply to the case, it is given a priority value of 10, which is the lowest priority. Thereafter, the case is re-prioritised every day along with all the other cases, during the Server service run.


Viewing and Updating Cases in Explorer

Explorer provides an interface to all of the cases raised in Sentinel or other source applications. Cases can also be manually added from within Explorer. Users with Case privileges can update cases and add commentary, in the case details and case commentary, in Explorer.

Case Management URLs

The URL command for the opening a case in Explorer is:

https://[server name]/P2.Explorer/cases/[CaseId] where [server name] is the name of the Explorer Server and [CaseId] is the case’s ID.


Managing Cases in a Test

If Case Management is enabled in Sentinel, you can configure the various states in a test to use it. 

 

Comments are closed