7 Integrating With A Change Management Server

Step 1: Configuring Change Management Integration

Configuring your Change Management Server is a two-step process handled through a single screen. First, specify the type of Change Management Server used along with all necessary connection parameters. Then indicate the default Categorization definition used to create a ticket for detected unauthorized changes. Using the Change Management Server screen, you can specify the type of Change Management server used, provide necessary connection information for the agent to connect to the server, and set up the default Outbound Ticket Configuration used in Auditing.

To access this screen, navigate to Administration --> Server Configuration --> Change Management Server.

To configure Change Management integration, follow these steps:

1. Ticket Management Type. Select the type of Change Management application used from the Ticket Management Type drop-down menu.

2. Device. Select the device whose agent will be used to connect to the ticket management server from the Device drop-down menu.

3. Server IP. Enter the IP address or hostname of the Change Management server. The agent does not have to be installed on this machine. If the agent is installed on the device where the application is running, you can enter localhost in the Server IP field.

4. Username and Password. Provide the username and password for the Change Management server. Be sure to specify the correct password. If an invalid password is used, the password must be corrected on this screen before categorization information can be collected. If you do not see the bottom half of the configuration screen appear after some time, the connection to the server most likely has failed either due to network connectivity or authentication.

5. Consolidate CTI. Specify whether to consolidate Change Ticket Information for change events. Specify the Consolidate CTI settings to control the number of unauthorized tickets created in your Change Management System. The field can accept a value of CT (one ticket will be generated per unique unauthorized Change Ticket combination and the ticket will be updated until the ticket is closed or the stop ticket update flag is set on the Change Management software), CT+D (one ticket will be generated per unique category and type combination and the device the change happened on), or None (each unauthorized change will generate one new ticket).

6. Ticket Correlation Criteria. Select the following criteria by clicking the associated check boxes. Correlation enables you to gather details about whether a change was authorized or unauthorized. Note that the CTI to Component Mapping is selected by default and is not configurable.

   • CTI to Component Mapping. Checks the Change Management server for a CTI for the current event application and a ticket state of Open or Emergency.

   • Time Window for Required Change (from Ticket). Checks whether the event change time is between the ticket's planned start and end times.

   • Devices(s) Where Change is to be Executed (from Ticket). Checks whether the event change device is in the ticket's device list.

   • User Assigned to Make Specified Changes (from Ticket). Checks whether the event change user is in the ticket's user list.

   • Approval timeout status for emergency ticket. Checks for an emergency ticket that has an expired approval status.

7. Click Save. Note that other configuration tabs Outbound Ticket, Ticket Expiry, and Emergency Ticket-can be configured at a later time.

8. Click the Update Agents button (to the right of the toolbar at the top of the screen) to update the agent on the device specified in step 2.

After you provide the connection parameters and update the Configuration Change Console agent, the agent will collect all categorization attributes from the Change Management server and save them within the Configuration Change Console database.

Depending on which Change Management Server with which you are integrating, you may have additional parameters that must be set in addition to the ones above. Here are some descriptions of these fields:

• Risk Level (used by the Remedy 7 adapter). The value you must set here needs to be a defined risk level in your Remedy 7 instance, such as “Risk Level 1”

• Impact (used by the Remedy 7 adapter). The value you must set here needs to be a defined impact in your Remedy 7 instance, such as “4-Minor/Localized”

• Location Company (used by Remedy 7 adapter). The value you must set here needs to be a defined company in your Remedy 7 instance, such as “Oracle Enterprise Manager” as given as an example in the installation guide on integrating with Remedy 7.

• Support Company (used by Remedy 7 adapter). The value you must set here needs to be a defined company in your Remedy 7 instance, such as “Oracle Enterprise Manager” as given as an example in the installation guide on integrating with Remedy 7.

Step 2: Configuring the Outbound Ticket Template

Configuration Change Console detects an unauthorized event for any monitored application, and if CT consolidation is not enabled, it creates a ticket on the Change Management server using the Outbound Ticket template. The outbound ticket template must be filled out before the server can create tickets for unauthorized events.

Note that Outbound Tickets are sent to the Change Management server with an "open" status. You can view a list of all Outbound Tickets from the Visualization ' Change Visualization ' Outbound Ticket History screen.

There are three ways to close a ticket created by the Configuration Change Console:

• An administrator closes the ticket on the Change Management server.

• The ticket expires upon reaching the ticket's planned end date. Unauthorized tickets have a default planned end date set to 24 hours following the ticket's creation.

• An administrator sets the "stop ticket update" flag on the Change Management server.

To access this screen, navigate to Administration --> Server Configuration --> Change Management Server.

Tabs at the bottom of the Change Management Server screen enable the three types of outbound ticket and emergency ticket settings.

To update the Outbound Ticket Configuration, follow these steps:

1. In the Outbound Ticket Configuration section of the screen, enter the following information:

   • Category Definition. The Categorization that the ticket being created for unauthorized events will receive. Drop-downs will be populated with the categorizations available from the Change Management System. This means that the Unauthorized/Unauthorized/Unauthorized categorization must be created on the Change Management Server.

   • Supervisor. The user on the Change Management server who will own the tickets created by Configuration Change Console. The list of users is populated by the users from the Change Management server that have the Send-to-AR flag checked on the user form.

   • Group. Optional field which allows you to assign the newly-created tickets to a group of people. The group name you enter here must exist on the Change Management Server.

   • Urgency. The urgency to which you want to set newly created unauthorized tickets. The urgency must be a valid value that is available in the Change Management server. Note that this field is case sensitive.

   • Priority. The priority to which you want to set newly created unauthorized tickets. The priority must be a valid value that is available in the Change Management server. Note that this field is case sensitive.

   Note:

   If you delete a setting on which the Outbound Ticket is dependent, such as a Categorization, ticket server or a specified supervisor, the Outbound Ticket will become invalid. The Audit Actions will not generate tickets for unauthorized activities until the Default Outbound Ticket is reconfigured.

2. Click Save to save the Outbound Ticket Configuration.

3. Click the Update Agents button (to the right of the toolbar at the top of the screen) to update the agent for the Change Management server.

Step 3: Assigning Categorizations to Component Instances

After setting up the Change Management Server and Outbound Ticket Configuration, you must assign categorizations to all component instances on which you want to audit authorized or unauthorized events.

Assign categorizations from the Category Component Assignments screen. Use the Category View to display a list of categorizations to which you can assign component instances. Alternatively, you can filter the screen output with the Component View, which displays a list of component instances to which you can assign categorizations.

To access this screen, navigate to Policy --> Operations Management --> Category Component Assignment.

To assign categorizations to a Component Instance (Category View), follow these steps:

1. Select the Category screen display mode from the Selection Mode.

2. Select the Change Management Server.

3. Filter the Category, Type and Item drop-down options or select All and then click Apply Filters.

4. From the categorization options shown in the table, select the checkbox for the ones you want to assign and click Assign New Component Instances.

5. From the Assign New Component Instances screen, select all component instances that should be associated with the categorization and click Save.

Step 4: Configuring Audit Actions for Authorized/Unauthorized Events

The last step in setting up auditing against the Change Management Server is to configure Audit Actions to perform Change Management actions on authorized/unauthorized events. The Audit Actions specify for certain component instances/applications if you want to create tickets for unauthorized events and/or update tickets for authorized events. Refer to the Configuring Audit Actions section to configure an audit action.

The created audit action will check events on the associated application against their mapped categorizations under the following circumstances:

• If detected changes are authorized, the tickets are updated in the Change Management Server with the event details.

• If Categorization Consolidation is disabled, a ticket will be created in the Change Management Server using the Outbound Ticket Template for each event that is unauthorized.

• If Consolidation is enabled, the unauthorized ticket with a categorization matching that of the unauthorized change event will be appended with the information for the change event. If no matching unauthorized ticket with matching categorization consolidation rules is found, a new ticket will be created using the Default Outbound Ticket configuration.

Emergency Change Process Flow

When an emergency ticket is received from a Change Management system, the Change Management Server retains the status of emergency (rather than open), to indicate that the ticket has not yet gone through the standard approval process. For the following 24 hours, any changes associated with this emergency ticket are treated as authorized. During this 24-hour timeframe, if no authorization action is taken and the emergency changes do not get approved, all changes associated with the emergency ticket are set to unauthorized and Configuration Change Console generates a new unauthorized ticket and populates it with relevant unauthorized events. The time out period of 24 hours can be configured when setting up the Change Management Integration.

A Ticket can have three states: Open, Closed, and Emergency. The following table lists the ticket states to the Configuration Change Console as they relate to Emergency Change Requests. Your Change Management server may have hundreds of possible states, but the definitions that are loaded at integration time will translate those states to one of these three states.

This emergency ticket feature is optional and can be enabled/disabled via the Change Management Server screen.

To enable emergency ticket configuration and also to configure emergency tickets, navigate to Administration --> Server Administration --> Change Management Server.

View the Outbound Ticket History for a list of authorized and unauthorized changes. Each entry shows the emergency ticket number, change event, application instance, and device. Navigate to Visualization --> Change Visualization --> Outbound Ticket History.

Monitoring Change Management Server Integration

Once you have configured the ticket management integration, use the Inbound Ticket History and Outbound Ticket History screens to view the tickets sent between the ticketing server and the Configuration Change Console.

The Inbound Ticket History screen shows all tickets sent from the Change Management Server that may be used to determine whether events are authorized. This screen can also show unauthorized tickets that were created by the Configuration Change Console. The Outbound Ticket History screen shows the tickets sent to the Change Management Server for either authorized or unauthorized events.