Service IT7C
Major Incident
Runs transactional. Starts when an upstream system posts an event. It runs 2,187 times a week across 8 stations. 4 of those stations stop for a person and 4 are done by an agent, none of them on the shared spine.
Runs a week
2,187
140 in flight right now.
Stations
8
4 person · 4 agent · 0 spine
Agent share of steps
50%
Autonomy on this service is set at 80% against a ceiling of 85%.
Decisions a person makes
4
Held by Director, Security Operations.
Touchless
82%
Share of runs that complete without anybody opening them.
Timetable against actual
0.8h
Actual 1.0h, 0.2h over the timetable.
Operations
The lane diagram
Read it left to right. more
Operations
Every station in order
The same stations as a list, with the dwell the estate records against each one and the system a station of that shape would touch.
| # | Station | Lane | Who | Layer | Dwell | Target | In flight | System |
|---|---|---|---|---|---|---|---|---|
| 1 | Declare Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged. | Human | Director, Security Operations | policy | 1h 12m | 1h 36m | 7 | IT Service Management |
| 2 | Contain | Agent | Threat Intelligence Agent | workflow | 1h 37m | 2h 8m | 46 | Configuration Management Database |
| 3 | Human commander Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged. | Human | Director, Security Operations | policy | 2h 29m | 5h 26m | 4 | IT Service Management |
| 4 | Assess exposure | Agent | Forensics Support Agent | workflow | 2h 31m | 3h 26m | 39 | IT Service Management |
| 5 | Legal notify Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged. Hands over at legal | Human | Director, Security Operations | policy | 4h 2m | 7h 56m | 8 | IT Service Management |
| 6 | Restore | Agent | Vulnerability Agent | workflow | 2h 59m | 4h 10m | 14 | Configuration Management Database |
| 7 | Post-mortem | Agent | Security Policy Agent | workflow | 54m | 2h 8m | 22 | IT Service Management |
| 8 | Board report Held for a named human when the unit exceeds the alert decision envelope, when confidence falls below the floor, or when a policy clause is engaged. | Human | Director, Security Operations | policy | 4h | 7h | 0 | IT Service Management |
Operations
Run it
Change the volume, move the autonomy line, release a gate, and watch what happens to the hours in each lane and to the time it takes one run to get through. more
The simulation is arithmetic on the estate, not a queueing model. more
How it runs
Run it again, going wrong
The same unit and the same stations, broken the way the estate already records breaking. more
8 stations, walked twice
Once clean, once with the categories the estate counts
This is the same unit on the same stations, breaking. more
No break below was chosen. more
One play head, two tracks, the same scale. The clean run stops when it runs out of stations; the other one keeps going.
As written
8 stations, nothing waiting, nothing sent back
0 min of 20 hrs
now Declare · Director, Security Operations · 1.2 hrs
As the ledger has it
the same stations, plus 5 categories the estate already counts
0 min of 40 hrs
now Declare · Director, Security Operations · 1.2 hrs
What breaks, and where it is counted
No break below was chosen. more
What the two runs say together
5 counted categories land on this procedure. more
What this run cannot claim
These breaks are shown together on one unit so the shape of a bad day fits on one screen. more
Attestations on this estate are written against intake items, not against procedures, so a step done off the platform cannot be matched to the attestation that covers it. more
Two clocks run. Worked time is the sum of the time the work is actually being done … more
Live observability
Systems this service would touch
Attributed by rule from the function's system list. more
2 systems attributed
0 of 2 returning records
IT Service Management
ServiceNow ITSM · itsm · bidirectional · high
6 of 8 stations attributed here · would write back
Configuration Management Database
ServiceNow CMDB · itsm · inbound · high
2 of 8 stations attributed here · read only
System attribution is a rule, not a reading. more
Who runs it
Orchestration and accountability
- Orchestrated by
- Security Operations Orchestrator
- That orchestrator’s remit
- Owns alert work end to end inside Information Technology. Runs 3 lines across 21 stations, drains the repeatable share into the AI-OPS tower, and holds 6 human gates.
- Accountable person
- Director, Security Operations
- Sub-function
- Cybersecurity Operations
- Shared spine tower
- Not on the shared spine
- Hand-over points
- legal
Other services in this sub-function
2 alongside this one
What this page is and is not
This is a catalogue of the modeled estate. more