SERVICES / OBSERVABILITY
Observability
A log source map, tuned alert list, and response steps for a specified incident scenario.
Define the response test
Incomplete incident telemetry
A log-source map and one tested incident scenario expose missing telemetry and response steps.
Log sources, alerts, and response steps
- 01Log sources, retention periods, and required fields listed by system
- 02SIEM and SOAR rules with missing sources and noisy alerts listed
- 03Tabletop exercise results with unresolved response steps
- 04On-call schedule and escalation paths matched to named responders
Process
- 01
Measure
Record the sources, fields, retention periods, and response gaps for the selected scenario.
- 02
Tune
Set thresholds, remove noisy alerts, and assign owners to missing coverage.
- 03
Rehearse
Run the scenario, record unresolved steps, and update the response playbooks.
Deliverables
- ✓Coverage map showing log sources, retention, and required fields for each system
- ✓Alert tuning backlog with severity and owner
- ✓Technical and executive incident playbooks
- ✓Escalation paths listing responder, trigger, and handoff
Log-source map and alert backlog
Use a recent alert, log-source list, or incident scenario. The review returns coverage checks and response steps.