JP2014115890A - System, method and program for inputting history of incident response - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a technique for automatically inputting a history of incident responses.SOLUTION: In an incident response history input system which includes a data center 100 and a monitoring center 200 connected to the data center 100 via a network 140, the monitoring center 200 includes an incident response history input unit 230 for acquiring a response history template corresponding to an incident ID, and the incident response history input unit 230 inputs a response history corresponding to the incident ID on the basis of information extracted from a log file and the response history template.

Description

  The present invention relates to an incident response history input system and method, and a program.

  In the incident response business, the service desk handles incidents (phenomena that pose security threats related to system operations such as unauthorized access and virus infection) that occur from fault monitoring devices.

  As a technical field of the present invention, there is, for example, JP 2009-181537 A (Patent Document 1). This gazette states that “from incident information and SLA (Service Level Agreement) information for each customer, the priority of each incident is dynamically changed, and an incident that degrades service quality is extracted and warned from this priority. Thus, even when different SLA is defined for each customer, it is possible to maintain the operational quality of the incident management work. "

JP 2009-181537 A

  With the technique described in Patent Document 1, it is possible to extract and warn incidents that degrade service quality based on priority.

  However, the technique described in Patent Document 1 cannot automatically input the service desk response history for incidents. Therefore, there has been a problem that man-hours are required to input a response history when responses to service desk incidents occur frequently. Also, the incident response history input performed by the service desk is a personal work, and there is a problem that the input contents vary depending on the service desk.

  An object of the present invention is to provide a technique for automatically inputting incident response history.

  The above and other objects and novel features of the present invention will be apparent from the description of this specification and the accompanying drawings.

  Of the inventions disclosed in the present application, the outline of typical ones will be briefly described as follows.

  To achieve the above object, a representative invention is an incident response history input system having a data center and a monitoring center connected to the data center via a network, and has the following features. The monitoring center has an incident response history input unit that acquires a response history template corresponding to an incident ID. Furthermore, the incident response history input unit solves the above-described problem by inputting a response history to the incident ID based on the information extracted from the log file and the response history template.

  The present invention can also be applied to a method by a system for automatically inputting incident response history and a program for causing a computer to function as a system for automatically inputting incident response history.

  Among the inventions disclosed in the present application, effects obtained by typical ones will be briefly described as follows.

  According to the present invention, incident response history can be automatically input.

It is a figure which shows the outline | summary of the structural example of the incident response log | history input system in one embodiment of this invention. FIG. 2 is a diagram illustrating a configuration example of an incident table stored in an incident DB in the incident response history input system of FIG. 1. In the incident response history input system of FIG. 1, it is a figure which shows the example of the response history memorize | stored in an incident table. FIG. 2 is a diagram illustrating a configuration example of a customer table stored in an incident DB in the incident response history input system of FIG. 1. In the incident response history input system of FIG. 1, it is a figure which shows the structural example of the transmission / reception log file which the transmission / reception log file DB memorize | stores. FIG. 2 is a diagram illustrating a configuration example of an operation log file stored in an operation log file DB in the incident response history input system of FIG. 1. FIG. 3 is a diagram illustrating a configuration example of a collection reception / transmission log table stored in a collection file DB in the incident response history input system of FIG. 1. FIG. 3 is a diagram illustrating a configuration example of a collection operation log table stored in a collection file DB in the incident response history input system of FIG. 1. FIG. 3 is a diagram illustrating a configuration example of a collection policy table stored in a collection policy DB in the incident response history input system of FIG. 1. (A), (b) is a figure which shows the structural example of the response history template which history creation template DB memorize | stores in the incident response history input system of FIG. FIG. 3 is a diagram illustrating an example of a process flow of incident response history input processing in the incident response history input system of FIG. 1. It is a figure which shows an example of the processing flow of the incident response log | history input process following FIG.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Note that components having the same function are denoted by the same reference symbols throughout the drawings for describing the embodiment, and the repetitive description thereof will be omitted.

<System configuration>
FIG. 1 is a diagram showing an outline of a configuration example of an incident response history input system according to an embodiment of the present invention. In FIG. 1, the incident response history input system includes, for example, a data center 100 and a monitoring center 200 connected to the data center 100 via a network 140.

  Further, the data center 100 and the monitoring center 200 are implemented by predetermined hardware and software. For example, the data center 100 and the monitoring center 200 include a processor, a memory, and the like, and the computers of the data center 100 and the monitoring center 200 function as an information transmission system by executing a program on the memory by the processor.

  The data center 100 includes a monitoring target device 110 and a failure monitoring device 120. The failure monitoring apparatus 120 monitors the monitoring target device 110. Then, the failure monitoring apparatus 120 transmits an incident (failure message) that has occurred in the monitored device 110 to the monitoring center. The incident management unit 210 receives the incident (failure message) transmitted by the failure monitoring apparatus 120.

  The monitoring center 200 includes an incident management unit 210, a CTI unit 220, an incident response history input unit 230, a transmission / reception log file DB 310, a collection policy DB 320, a history creation template DB 330, an operation log file DB 340, and an incident DB 350. And a collection file DB 380 and an operation unit 10.

  The incident management unit 210 receives the incident (failure message) transmitted by the data center 100, and stores the received incident (failure message) in the incident table 360 of the incident DB 350 (Database).

  The service desk refers to the incident stored in the incident table 360, notifies the customer of the content of the incident via the CTI unit 220 based on the procedure manual corresponding to the incident, and responds to the monitored device 110. I do.

  The incident response history input unit 230 acquires the response history template 460 corresponding to the incident ID. Further, the incident response history input unit 230 inputs the response history corresponding to the incident ID to the incident table 360 based on the information extracted from the log file and the response history template 460. Further, the incident response history input unit 230 extracts information from the log file based on the collection policy acquired from the collection policy table 450 stored in the collection policy DB 320.

<Detailed configuration>
FIG. 2 is a diagram illustrating a configuration example of the incident table 360 stored in the incident DB 350. The incident table 360 includes [incident ID], [occurrence date / time], [host name], [occurrence system], [customer name], [message], [response case], [response history], [acceptance date], [ Data items such as [Completion date and time]. [Incident ID] is a symbol for identifying an incident. [Occurrence date and time] indicates the date and time when the incident occurred. [Host name] indicates the name of the monitoring target device 110 in which the incident has occurred. [Generation system] indicates the name of the data center 100. [Customer name] indicates the name of the customer. [Message] indicates the content of the incident. [Corresponding Case] is information added by the incident management unit 210, and indicates a corresponding case for the incident. [Correspondence history] stores the contents of FIG. 3 to be described later. [Reception Date / Time] indicates the date and time when the incident is stored in the incident table 360. [Response completion date and time] indicates the date and time when the response to the incident was completed.

  FIG. 3 is a diagram illustrating an example of the response history stored in [Response History] of the incident table 360. The correspondence history is as follows: “2012-07-10 10:02:15 Report the failure to Company A” “2012-07-10 10:05:42 Log in to Host1 from tanmatsu1 and check the startup of the XYZ process” The date and time and the corresponding contents are stored in association with each other.

  FIG. 4 is a diagram illustrating a configuration example of the customer table 370 stored in the incident DB 350. The customer table 370 includes data items such as [customer name], [name of person in charge], [contact 1], [contact 2], and [contact 3]. [Customer name] indicates the name of the customer. [Name of person in charge] indicates the name of the person in charge on the customer side. [Contact 1], [Contact 2], and [Contact 3] indicate customer contacts.

  FIG. 5 is a diagram illustrating a configuration example of a transmission / reception log file stored in the transmission / reception log file DB 310. The incoming / outgoing log file is a record consisting of data items such as [date / time], [incoming / outgoing call information] indicating whether it was received or sent, [phone number], [user name], and [call time]. Is stored in memory. [Date / Time] indicates the date / time when the received / sent log file is received or transmitted. [Reception / transmission information] indicates whether the reception / transmission log file is received or transmitted. [Telephone number] indicates a telephone number received or transmitted. [User name] indicates the name of the service desk. [Call duration] indicates the time when the service desk talks to the customer.

  FIG. 6 is a diagram illustrating a configuration example of an operation log file stored in the operation log file DB 340. The operation log file stores a plurality of records including data items such as [date / time], operated [terminal name], [user name], [center name] to be operated, and [operation details]. [Date / Time] indicates the date / time when the service desk operated.

  FIG. 7 is a diagram illustrating a configuration example of the collection reception / transmission log table 400 stored in the collection file DB 380. The collection reception / transmission log table 400 includes data items such as [date / time], [transmission / reception information], [phone number], [user name], [call time], and [collection period]. [Collection period] indicates a period for collecting logs.

  FIG. 8 is a diagram illustrating a configuration example of the collection operation log table 410 stored in the collection file DB 380. The collection operation log table 410 includes data items such as [date / time], [terminal name], [user name], [center name], [operation content], and [collection period].

  FIG. 9 is a diagram illustrating a configuration example of the collection policy table 450 stored in the collection policy DB 320. The collection policy table 450 stored in the collection policy DB 320 includes data items such as [target], [file path], [collection period], [condition 1], and [condition 2]. [Target] indicates either a transmission / reception log or an operation log. [File path] indicates the location where the corresponding log is stored. [Condition 1] and [Condition 2] indicate conditions other than the collection period for collecting logs.

  FIGS. 10A and 10B are diagrams illustrating a configuration example of the correspondence history template 460 stored in the history creation template DB 330. The history creation template DB 330 stores a correspondence history template 460 for each [correspondence case]. Each correspondence history template 460 includes data items such as [number of rows], [collection period], [history of registered history character string], [log type], and [log search condition]. [Collection period] corresponds to the data item of [Collection period] in the table of FIG. The “history of registered history character string” indicates the content input in the “response history” of the incident management unit 210 (described above, FIG. 3). In the example of FIG. 10, “custom name” acquired from the incident table 360 using the incident ID as a key is input to “XX”, and the content extracted from the log file is input to “□□□”. Is done. [Log type] indicates the type of the collected log, and corresponds to the content stored in the [Target] data item of the table of FIG. [Log Search Condition] indicates a condition for extracting a log file.

<Incident response history input process>
FIG. 11 and FIG. 12 are diagrams showing an example of the processing flow of incident response history input processing in this system. In addition, FIG. 12 is a figure following FIG.

  First, in S <b> 901, the incident response history input unit 230 receives [incident ID] from the operation unit 10. Note that the [incident ID] is input by the operation unit 10 from the service desk.

  Next, in S902, the incident response history input unit 230 acquires the collection policy from the collection policy table 450 stored in the collection policy DB 320. The collection policy includes [File path], [Collection period], [Condition 1], [Condition 2] in the sending / receiving log and [File path], [Collection period], [Condition 1], [Condition] in the operation log. Condition 2].

  Next, in S903, the incident response history input unit 230 searches the incident table 360 using the [incident ID] received in S901 and the [collection period] of the transmission / reception log acquired in S902 as keys, Get the date and time of the incoming / outgoing log corresponding to the key. Further, the incident response history input unit 230 searches the incident table 360 using the [incident ID] received in S901 and the [collection period] of the operation log acquired in S902 as keys, and the operation log corresponding to the key Get the date and time. For example, if the incident ID is 1000, the [collection period] of the incoming / outgoing log consists of “acceptance date / time” and “response completion date / time”, and the [collection period] of the operation log is “occurrence date / time” The date and time acquired from the incident table 360 of No. 2 is “2012-07-10 10:00:20 (reception date)” and “2012-07-10 10:15:11 (response completion date)”. , The operation log becomes “2012-07-10 10:00: 00 (occurrence date)”.

  Next, in S904, the incident response history input unit 230 searches the transmission / reception log file stored in [File path] of the transmission / reception log acquired in S902 using the date / time of the transmission / reception log acquired in S903 as a key. And extract records that contain the matching date and time. Then, the extracted record is stored in the collection reception / transmission log table 400 of the collection file DB 380 in association with the [collection period]. In addition, the incident response history input unit 230 searches the operation log file stored in [File path] of the operation log acquired in S902 using the operation log date and time acquired in S903 as a key, and records including the matching date and time To extract. Then, the extracted record is stored in the collection operation log table 410 of the collection file DB 380 in association with the [collection period].

  Next, in S905, the incident response history input unit 230 determines whether or not all records have been extracted from the log file (receiving / receiving log file and operation log file) in S904 based on the collection policy acquired in S902. Determine. If it is determined that not all records have been extracted from the log file (S905-Yes), the process proceeds to S904. On the other hand, when it is determined that all records have been extracted from the log file (S905-No), the process proceeds to S906.

  Next, in S906, the incident response history input unit 230 searches the incident table 360 using the incident ID received in S901 as a key, and acquires a [response case] corresponding to the key.

  Next, in S907, the incident response history input unit 230 searches the history creation template DB 330 using the [response case] acquired in S906 as a key, and acquires the corresponding response history template 460.

  Next, in S908, the incident response history input unit 230 sets “number of rows” referring to the acquired response history template 460 as “1”.

  Next, in S909, the incident response history input unit 230 determines that the [Log Type] is the incoming / outgoing log according to the [Log Type] of the [Number of Rows] record that refers to the response history template 460 acquired in S907. If the log type is an operation log, the collection operation log table 410 or the collection operation log is searched. The table 410 is searched based on [log search condition], and the corresponding record is extracted. More specifically, when [Log Search Condition] is “Telephone Number = 03−XXX × −XXX and Call / Receive Information = Call”, [Phone Number] is 03−XXX. A record that is × —xxxx and [transmission / reception information] is outgoing is extracted.

  In step S <b> 910, the incident response history input unit 230 determines whether the record extracted in step S <b> 909 is stored in the “response history” of the incident table 360. If the record extracted in S909 is stored in [Reaction History] of the incident table 360 (S910-Yes), the process proceeds to S914. On the other hand, when the record extracted in S909 is not stored in the [response history] of the incident table 360 (S910-No), the process proceeds to S911.

  Next, in S911, the incident response history input unit 230 searches the incident table 360 using the incident ID received in S901 as a key, and acquires the corresponding [customer name]. Then, the acquired [customer name] is input to “XX” of “history of registered history character string” of the correspondence history template 460. If the [log type] of the response history template 460 is an operation log, the incident response history input unit 230 searches the collection file DB 380 using the [collection period] of the response history template 460 as a key, and selects the corresponding [terminal name] ] To get. Then, the acquired [terminal name] is input to “□□□” of “history of registered history character string” of the correspondence history template 460.

  Next, in S912, the incident response history input unit 230 searches the collection file DB 380 using the [collection period] and [log type] of the response history template 460 as keys, and acquires the corresponding date and time. Then, the acquired date / time is input as the date / time of [Correspondence History] in the incident table 360. In S911, the “history of registered history character string” of the response history template 460 after the input to “XXX” and “□□□” is input to the “response history” of the incident table 360 as the corresponding content.

  In step S <b> 913, the incident response history input unit 230 determines whether the date and the response content have been input to the incident table 360 for records corresponding to all [number of rows] in the response history template 460. . For the records corresponding to all [number of rows], when the date and the corresponding contents are input (S913-No), the process is terminated. On the other hand, when the date and the corresponding content have not been input for all the records corresponding to [number of rows] (S913-Yes), the process proceeds to S914. In S914, [number of rows] is incremented, and the process proceeds to S909.

  Here, in the incident response history input method and program of the present invention, S906 and S907 correspond to the first step, and S909 to S914 correspond to the second step.

<Effects of the present embodiment>
According to the incident response history input system in the present embodiment described above, the incident response history is obtained by inputting the response history corresponding to the incident ID based on the information extracted from the log file and the response history template. It becomes possible to input automatically.

  In addition, the incident response history input unit automatically extracts incident response history based on the information extracted from the log file based on the collection policy and the response history template by extracting information from the log file based on the collection policy. It becomes possible to input with.

  As mentioned above, although the invention made | formed by this invention was concretely demonstrated based on embodiment, this invention is not limited to the said embodiment, It can change variously in the range which does not deviate from the summary. Needless to say.

  The present invention has an excellent effect that an incident response history can be automatically input, and can also be applied to an incident response history input system, method, and program.

DESCRIPTION OF SYMBOLS 10 Operation part 100 Data center 110 Monitoring object apparatus 120 Fault monitoring apparatus 140 Network 200 Monitoring center 210 Incident management part 220 CTI part 230 Incident handling log | history input part 310 Transmission / reception log file DB
320 Collection Policy DB
330 History creation template DB
340 Operation log file DB
350 Incident DB
360 Incident table 370 Customer table 380 Collection file DB
400 Collection reception / transmission log table 410 Collection operation log table 450 Collection policy table 460 Correspondence history template

Claims (6)

An incident response history input system having a data center and a monitoring center connected to the data center via a network,
The monitoring center has an incident response history input unit for acquiring a response history template corresponding to an incident ID,
The incident response history input system, wherein the incident response history input unit inputs a response history to the incident ID based on information extracted from a log file and the response history template. In the incident response history input system according to claim 1,
The incident response history input system, wherein the incident response history input unit extracts the information from the log file based on a collection policy. An incident response history input method in an incident response history input system having a data center and a monitoring center connected to the data center via a network,
A first step of acquiring a response history template corresponding to an incident ID by the monitoring center; a second step of inputting a response history to the incident ID based on information extracted from a log file and the response history template; An incident response history input method characterized by comprising:   4. The incident response history input method according to claim 3, wherein, in the second step, the response history is input to the incident ID based on the information extracted from the log file based on a collection policy and the response history template. Incident response history input method. A program for causing a computer of an incident response history input system having a data center and a monitoring center connected to the data center via a network,
A first step of acquiring a response history template corresponding to an incident ID by the monitoring center; a second step of inputting a response history to the incident ID based on information extracted from a log file and the response history template; , Causing the computer to execute the incident response history input program.   6. The program according to claim 5, wherein in the second step, the response history is input to the incident ID based on the information extracted from the log file based on a collection policy and the response history template. Incident response history input program.

Images