Add docs for incident response app (EE, Closed Alpha) #3047

jasonblais · 2019-10-11T03:52:45Z

No description provided.

source/administration/incident-response-application.rst

crspeller · 2019-10-21T23:37:25Z

@jasonblais Added examples here: #3094

The examples won't work until a bug fix is applied: https://github.com/mattermost/mattermost-plugin-workflow/pull/41

jasonblais

This is ready for review. Please see attached comments for FYIs or questions.

@crspeller (dev review) @amyblais (editor review) @wiersgallak (PM review) -- cc @justinegeffen if time to review

jasonblais · 2019-10-27T23:20:49Z

source/administration/incident-response-application.rst

@@ -0,0 +1,667 @@
+Incident Response Application (EE, Closed Alpha)


I'm open to feedback on the length of this page and whether we'd want to break into separate smaller pages.

As a note, 80% of this is configuration, as I wanted to make it all-inclusive for the JSON configuration with all info available in one place. The configuration will be much simpler once it’s moved to the UI.

jasonblais · 2019-10-27T23:21:07Z

source/administration/incident-response-application.rst

+
+Below is an example of the incident response app automatically creating a channel from a Nagios alert, adding users to the channel and providing them quick actions to take on the incident.
+
+.. image:: ../images/incident-response-app-intro-image.png


FYI - Username and pic may change, using what we have at the moment

source/administration/incident-response-application.rst

jasonblais · 2019-10-27T23:22:17Z

source/administration/incident-response-application.rst

+.. image:: ../images/incident-response-app-intro-image.png
+   :alt: Incident Response App: Intro Image
+
+.. image:: ../images/incident-response-app-intro-image-fullpage.png


@amyblais Question: Do images typically have a border? If yes, how is it added (is it locally via image editing program)?

This should be a question for UX. @asaadmahmood

source/administration/incident-response-application.rst

jasonblais · 2019-10-27T23:24:31Z

source/administration/incident-response-application.rst

+
+  In this example, ``{{.Action.CreateWarroom.ChannelName}}`` pulls the channel name used in an ``CreateWarroom`` action, which is the example of the ``create_channel`` action above, and posts a message to that channel.
+
+**Fields and Transitions**


Open for feedback on how to describe these two parameters.

Co-Authored-By: Amy Blais <amy_blais@hotmail.com>

jasonblais · 2019-10-29T01:11:01Z

@amyblais all editor feedback addressed. I see a merge conflict (not sure why), I'll resolve that once PM/UX feedback shared

wiersgallak · 2019-10-29T18:39:49Z

source/administration/incident-response-application.rst

+
+The incident response application is available in closed Alpha and is supported in Mattermost 5.12 and later.
+
+Use the incident response application to connect all your workflows, automate repetitive tasks and collaborate on incidents within one secure messaging platform. Sample use cases you can accomplish with this app include the following:


The sentence "Sample use cases you can accomplish with this app include the following" this reads tricky for me. Recommend "This app will allow you to accomplish the following sample use cases:"

wiersgallak · 2019-10-29T18:43:13Z

source/administration/incident-response-application.rst

+Use the incident response application to connect all your workflows, automate repetitive tasks and collaborate on incidents within one secure messaging platform. Sample use cases you can accomplish with this app include the following:
+
+1. Trigger automated incident response workflows based on keywords.
+2. Automatically mention your InfoSec or DevSecOps teams when an incident occurs, including via email, mobile push and desktop notifications.


Recommend simplifying this:
"Automatically mention your InfoSec or DevSecOps teams when an incident occurs and notify them via email, mobile push or desktop."

Also wondering if 2 should come after 3 - understand its a use case, but it also reads a little bit as the process.

wiersgallak · 2019-10-29T18:44:33Z

source/administration/incident-response-application.rst

+1. Trigger automated incident response workflows based on keywords.
+2. Automatically mention your InfoSec or DevSecOps teams when an incident occurs, including via email, mobile push and desktop notifications.
+3. Auto-create "war rooms" and invite key team members to immediately collaborate on a critical incident.
+4. Take quick actions, review data and access relevant links all in one place.


Wondering if we should outline what "quick actions" mean. ie: Take quick actions like triaging or assign tasks, review data, and access relevant links all in one place.

wiersgallak · 2019-10-29T18:48:26Z

source/administration/incident-response-application.rst

+2. Automatically mention your InfoSec or DevSecOps teams when an incident occurs, including via email, mobile push and desktop notifications.
+3. Auto-create "war rooms" and invite key team members to immediately collaborate on a critical incident.
+4. Take quick actions, review data and access relevant links all in one place.
+5. Archive resolved incidents to declutter your channel sidebar without losing access to past information.


Recommend highlighting benefit more here first 0/5 "Archive resolved incidents to keep a record of the resolution and keep channel sidebar decluttered. "

wiersgallak · 2019-10-29T18:50:36Z

source/administration/incident-response-application.rst

+How Can I Try The App?
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+1. `Sign up for the closed Alpha program <https://docs.google.com/forms/d/e/1FAIpQLSf4Rr1YnofQQnKHJuL0Cgz_DaCUitt_Atik7K9KXsDefCyXlg/viewform>`_. If you're selected to join the Alpha program, you will receive an email from us with a plugin binary.


Maybe add an expectation of what is expected of customers who join the Alpha program is. Like working closely with the PM team to refine design, functionality, and rigorous testing of the feature.

wiersgallak · 2019-10-29T18:55:56Z

source/administration/incident-response-application.rst

+  ]
+
+.. tip::
+  If the ``create_channel`` action attempts to create a channel that already exists, the workflow fails to continue as it's unable to create that said channel.


Recommend being more direct in this sentence "...the workflow fails as it is unable to create a channel duplicate of one that already exists."

wiersgallak · 2019-10-29T19:03:10Z

source/administration/incident-response-application.rst

+.. tip::
+  If the ``create_channel`` action attempts to create a channel that already exists, the workflow fails to continue as it's unable to create that said channel.
+
+  Therefore, it is highly recommended that you use instance template variables to define ``channel_name`` and ``channel_displayname`` parameters to avoid non-unique channel names. For instance, if you define the channel name to be ``system-incident-{{.Instance.Number}}`` such as in the app workflow JSON example above, channels are created with names ``system-incident-1``, ``system-incident-2``, and so forth, avoiding duplicate names.


Recommending additional simplification of this content (hoping I didnt lose too much meaning in my changes):

It is highly recommended that you use instance template variables to define channel_name and channel_displayname. For instance, defining the channel name in your workflow assystem-incident-{{.Instance.Number}} will create channels with names system-incident-1, system-incident-2each time the workflow runs, thereby ensuring unique names and preventing duplicate names.

source/administration/incident-response-application.rst

wiersgallak · 2019-10-29T19:11:02Z

source/administration/incident-response-application.rst

+
+The following are some of the use cases we plan to support in a future Beta or stable release:
+
+1. Pulling remote data to, for instance, look up responders who are on duty from an external system or from AD/LDAP, and notifying them about a new incident.


This is hard to read. Here is an idea, but feel free to change.

Integrating with data in other systems, for example, looking up users in an external system who may be "on-call" and need to be notified of a new event.

jasonblais

@wiersgallak Excellent feedback, thank you so much!! Addressed, plus left two comments

source/administration/incident-response-application.rst

* master: Equalsigns had been replaced with hyphen (#3139) v5.16.3 / v5.15.3 dot release docs (#3133) Change three dots > hamburger menu (#3134) Update permalink for help wanted issues (#3034) Update install-mmte-helm-gitlab-helm.rst (#3109) Update incident-response-application.rst (#3127) Update ESR docs (#3116) Update time and link info of the developers meeting (#3123) Add docs for incident response app (EE, Closed Alpha) (#3047) 5.16.2 dot release docs (#3117) Update plugins.rst (#3114) Moved Zoom docs to Zoom repo (#3069) Move workflow samples to ../samples/incident-response-app (#3113) Updated mattermost username in () (#3112)

Create incident-response-application.rst

11de9e6

jasonblais added the Work In Progress Not yet ready for review label Oct 11, 2019

jasonblais added 10 commits October 15, 2019 10:38

Add TOC, sample workflow, permissions and mgmt of workflows

4d3519a

Add troubleshooting steps

588e60b

Add steps to try the app

254d616

Add sample use cases, JSON schema config docs, roadmap

841c0ec

Some formatting fixes

c07af08

Update incident-response-application.rst

47742e6

Update incident-response-application.rst

f8ed1ca

Update incident-response-application.rst

6c8631d

Update incident-response-application.rst

29e2f30

Update incident-response-application.rst

728d782

jasonblais commented Oct 17, 2019

View reviewed changes

source/administration/incident-response-application.rst Show resolved Hide resolved

jasonblais commented Oct 21, 2019

View reviewed changes

source/administration/incident-response-application.rst Outdated Show resolved Hide resolved

crspeller requested changes Oct 21, 2019

View reviewed changes

jasonblais mentioned this pull request Oct 27, 2019

Move workflow samples to ../samples/incident-response-app #3113

Merged

jasonblais added 10 commits October 27, 2019 13:56

Add files via upload

a2bd8e2

Update incident-response-application.rst

f7f96f7

Add files via upload

a709936

Fix formatting issues, some other cosmetic improvements

df55960

Add to TOC

f52b333

Fix issue with image

cc44ac9

Add files via upload

fd13827

Add files via upload

2bd8027

Update transition_to and post action type config docs

3ea5e6f

Move stats to its own section; increase TOC depth to 2

bb503a5

jasonblais commented Oct 27, 2019

View reviewed changes

jasonblais requested review from amyblais and crspeller October 27, 2019 23:26

Update source/administration/incident-response-application.rst

3d16923

Co-Authored-By: Amy Blais <amy_blais@hotmail.com>

crspeller approved these changes Oct 28, 2019

View reviewed changes

jasonblais and others added 10 commits October 28, 2019 13:39

Update source/administration/incident-response-application.rst

dc25680

Co-Authored-By: Amy Blais <amy_blais@hotmail.com>

Update source/administration/incident-response-application.rst

ce8cc44

Co-Authored-By: Amy Blais <amy_blais@hotmail.com>

Update source/administration/incident-response-application.rst

c097602

Co-Authored-By: Amy Blais <amy_blais@hotmail.com>

Update source/administration/incident-response-application.rst

9209a67

Co-Authored-By: Amy Blais <amy_blais@hotmail.com>

Update source/administration/incident-response-application.rst

3a2623c

Co-Authored-By: Amy Blais <amy_blais@hotmail.com>

Update source/administration/incident-response-application.rst

46f1e82

Co-Authored-By: Amy Blais <amy_blais@hotmail.com>

Update source/administration/incident-response-application.rst

b3808c5

Co-Authored-By: Amy Blais <amy_blais@hotmail.com>

Update source/administration/incident-response-application.rst

3719bd0

Co-Authored-By: Amy Blais <amy_blais@hotmail.com>

Update incident-response-application.rst

2cc84d9

Update incident-response-application.rst

d617998

jasonblais removed the 1: Dev Review Requires review by a core commiter label Oct 29, 2019

amyblais approved these changes Oct 29, 2019

View reviewed changes

amyblais removed the 2: Editor Review Requires review by an editor label Oct 29, 2019

wiersgallak reviewed Oct 29, 2019

View reviewed changes

asaadmahmood approved these changes Oct 30, 2019

View reviewed changes

Address PM review feedback

92f2ad4

jasonblais commented Oct 30, 2019

View reviewed changes

source/administration/incident-response-application.rst Show resolved Hide resolved

source/administration/incident-response-application.rst Show resolved Hide resolved

Update incident-response-application.rst

b9b3b8a

jasonblais requested a review from wiersgallak October 30, 2019 23:44

wiersgallak approved these changes Oct 31, 2019

View reviewed changes

wiersgallak added 3: Reviews Complete All reviewers have approved the pull request and removed 1: PM Review Requires review by a product manager labels Oct 31, 2019

Merge branch 'master' into jasonblais-patch-5

4b145f4

crspeller merged commit b6802c5 into master Oct 31, 2019

crspeller deleted the jasonblais-patch-5 branch October 31, 2019 18:12

amyblais removed the 3: Reviews Complete All reviewers have approved the pull request label Nov 4, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add docs for incident response app (EE, Closed Alpha) #3047

Add docs for incident response app (EE, Closed Alpha) #3047

jasonblais commented Oct 11, 2019

crspeller commented Oct 21, 2019

jasonblais left a comment

jasonblais Oct 27, 2019

jasonblais Oct 27, 2019

jasonblais Oct 27, 2019

amyblais Oct 28, 2019

jasonblais Oct 27, 2019

jasonblais commented Oct 29, 2019

wiersgallak Oct 29, 2019

wiersgallak Oct 29, 2019

wiersgallak Oct 29, 2019

wiersgallak Oct 29, 2019

wiersgallak Oct 29, 2019

wiersgallak Oct 29, 2019

wiersgallak Oct 29, 2019

wiersgallak Oct 29, 2019

jasonblais left a comment

		@@ -0,0 +1,667 @@
		Incident Response Application (EE, Closed Alpha)


		Below is an example of the incident response app automatically creating a channel from a Nagios alert, adding users to the channel and providing them quick actions to take on the incident.

		.. image:: ../images/incident-response-app-intro-image.png


		In this example, ``{{.Action.CreateWarroom.ChannelName}}`` pulls the channel name used in an ``CreateWarroom`` action, which is the example of the ``create_channel`` action above, and posts a message to that channel.

		Fields and Transitions


		The incident response application is available in closed Alpha and is supported in Mattermost 5.12 and later.

		Use the incident response application to connect all your workflows, automate repetitive tasks and collaborate on incidents within one secure messaging platform. Sample use cases you can accomplish with this app include the following:


		The following are some of the use cases we plan to support in a future Beta or stable release:

		1. Pulling remote data to, for instance, look up responders who are on duty from an external system or from AD/LDAP, and notifying them about a new incident.

Add docs for incident response app (EE, Closed Alpha) #3047

Add docs for incident response app (EE, Closed Alpha) #3047

Conversation

jasonblais commented Oct 11, 2019

crspeller commented Oct 21, 2019

jasonblais left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jasonblais commented Oct 29, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jasonblais left a comment

Choose a reason for hiding this comment